freeipa

Clone
Source Code
GIT

#6937 Provide an API command to retrieve PKINIT status in the FreeIPA topology
Closed: fixed 6 years ago Opened 6 years ago by mbabinsk.

Closed: fixed
Reopen Issue

In mixed FreeIPA topologies (pre 4.5 and 4.5 masters) it may be useful to have a tool reporting masters which have PKINIT enabled. This could greatly simplify troubleshooting in cases when some of the clients attempt to request TGT via PKINIT and fail (maybe due to resolving a old KDC that does not understand PKINIT yet).

Since PKINIT is an attribute of KDC shared by multiple masters, we may reuse the Server-Roles API (after slight modifications) to report PKINIT status based on pkinitEnabled value set on KDC entry's ipaConfigString. This can be reported in ipaconfig and we can also provide a dedicated ipa pkinit-status command to retrieve this info.

Metadata Update from @pvoborni:
- Issue priority set to: blocker
- Issue set to the milestone: FreeIPA 4.5.1
6 years ago

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1449523
6 years ago

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1449523
6 years ago

Issue linked to bug 1449523

Metadata Update from @pvoborni:
- Issue assigned to mbabinsk
6 years ago

Metadata Update from @mbasti:
- Issue set to the milestone: FreeIPA 4.5.2 (was: FreeIPA 4.5.1)
6 years ago

FreeIPA 4.5.2

ipa-4-5:

  • c4aa3a1 Allow for multivalued server attributes
  • 753f8cf Refactor the role/attribute member reporting code
  • fbccb74 Add an attribute reporting client PKINIT-capable servers
  • 733cef9 Add the list of PKINIT servers as a virtual attribute to global config
  • 6b815aa Add pkinit-status command
  • 4fa29a3 test_serverroles: Get rid of MockLDAP and use ldap2 instead

master:

  • bddb90f Allow for multivalued server attributes
  • cac7e49 Refactor the role/attribute member reporting code
  • d8bb23a Add an attribute reporting client PKINIT-capable servers
  • f805532 Add the list of PKINIT servers as a virtual attribute to global config
  • 9935273 Add pkinit-status command
  • 58fd229 test_serverroles: Get rid of MockLDAP and use ldap2 instead

Metadata Update from @mbabinsk:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
6 years ago

Login to comment on this ticket.

Metadata
None
None
None
critical
None
None
None
None
None
None
None
None
None
None
None
None
None
None
https://bugzilla.redhat.com/show_bug.cgi?id=1449523
None
None
None
Powered by Pagure 5.13.3
Documentation • File an Issue • About • SSH Hostkey/Fingerprint
© Red Hat, Inc. and others.