January 2020 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#4111][opened] Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit
by rcritten 13 Jan '20

13 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4111 Author: rcritten Title: #4111: Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit Action: opened PR body: """ A "cookie" is used with certmonger to track the state of a request across multiple requests to a CA (in ca-cookie). This is used with the certmonger POLL operation to submit a request to the CA for the status of a certificate request. This, along with the profile, are passed to the certmonger CA helper scripts via environment variables when a request is made. It is cleared from the certmonger request once the certificate is issued. This CA helper can do a number of things: - SUBMIT new certicate requests (including the CA) - POLL for status of an existing certificate request - For non renewal masters, POLL to see if an updated cert is in LDAP A POLL operation requires a cookie so that the state about the request can be passed to the CA. For the case of retrieving an updated cert from LDAP there is no state to maintain. It just checks LDAP and returns either a cert or WAIT_WITH_DELAY if one is not yet available. There are two kinds of cookies in operation here: 1. The CERTMONGER_CA_COOKIE environment variable passed via certmonger to this helper which is a JSON object. 2. The cookie value within the JSON object which contains the URL to be passed to dogtag. For the purposes of clarity "cookie" here is the value within the JSON. The CERTMONGER_CA_COOKIE is deconstructed and reconstructed as the request is processed, doing double duty. It initially comes in as a JSON dict object with two keys: profile and cookie. In call_handler the CERTMONGER_CA_COOKIE is decomposed into a python object and the profile compared to the requested profile (and request rejected if they don't match) and the cookie key overrides the CERTMONGER_CA_COOKIE environment variable. This is then reversed at the end of the request when it again becomes a JSON object containing the profile and cookie. This script was previously enforcing that a cookie be available on all POLL requests, whether it is actually required or not. This patch relaxes that requirement. The first request of a non-renewal master for an updated certicate from LDAP is a SUBMIT operation. This is significant because it doesn't require a cookie: there is no state on a new request. If there is no updated cert in LDAP then the tracking request goes into the CA_WORKING state and certmonger will wait 8 hours (as returned by this script) and try again. Subsequent requests are done using POLL. This required a cookie so all such requests would fail with the ca-error Invalid cookie: u'' as it was empty (because there is no state). There is no need to fail early on a missing cookie. Enforcement will be done later if needed (and it isn't always needed). So if CERTMONGER_CA_COOKIE is an empty string then generate a new CERTMONGER_CA_COOKIE containing the requested profile and an empty cookie. It still will fail if certmonger doesn't set a cookie at all. An example of a cookie when retrieving a new RA Agent certificate is: {"profile": "caServerCert", "cookie": "state=retrieve&requestId=20"} This will result in this request to the CA: [09/Jan/2020:14:29:54 -0500] "GET /ca/ee/ca/displayCertFromRequest?requestId=20&importCert=true&xml=true HTTP/1.1" 200 9857 For a renewal, the reconstructed cookie will consist of: {"profile": "caServerCert", "cookie": ""} https://pagure.io/freeipa/issue/8164 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4111/head:pr4111 git checkout pr4111

1 1

[freeipa PR#4116][opened] [Backport][ipa-4-7] AD user without override receive InternalServerError with API
by flo-renaud 13 Jan '20

13 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4116 Author: flo-renaud Title: #4116: [Backport][ipa-4-7] AD user without override receive InternalServerError with API Action: opened PR body: """ This PR was opened automatically because PR #4110 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4116/head:pr4116 git checkout pr4116

1 1

[freeipa PR#4115][opened] [Backport][ipa-4-8] AD user without override receive InternalServerError with API
by flo-renaud 13 Jan '20

13 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4115 Author: flo-renaud Title: #4115: [Backport][ipa-4-8] AD user without override receive InternalServerError with API Action: opened PR body: """ This PR was opened automatically because PR #4110 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4115/head:pr4115 git checkout pr4115

1 1

[freeipa PR#4089][opened] ipatests: Add integration test for valid/invalid inputs for kerberos ticket policy.
by amore17 13 Jan '20

13 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4089 Author: amore17 Title: #4089: ipatests: Add integration test for valid/invalid inputs for kerberos ticket policy. Action: opened PR body: """ This checks that valid/invalid inputs for subtypes of authentication indicator kerberos ticket policy options. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4089/head:pr4089 git checkout pr4089

2 1

[freeipa PR#4120][opened] [testing_ipa-4.6] Nightly PR
by freeipa-pr-ci 12 Jan '20

12 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4120 Author: freeipa-pr-ci Title: #4120: [testing_ipa-4.6] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4120/head:pr4120 git checkout pr4120

1 0

[freeipa PR#4098][opened] [testing_ipa-4.6] Nightly PR
by freeipa-pr-ci 12 Jan '20

12 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4098 Author: freeipa-pr-ci Title: #4098: [testing_ipa-4.6] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4098/head:pr4098 git checkout pr4098

1 1

[freeipa PR#4097][opened] [testing_ipa-4.7] Nightly PR
by freeipa-pr-ci 12 Jan '20

12 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4097 Author: freeipa-pr-ci Title: #4097: [testing_ipa-4.7] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4097/head:pr4097 git checkout pr4097

1 1

[freeipa PR#4118][opened] [testing_ipa-4.8] Nightly PR
by freeipa-pr-ci 11 Jan '20

11 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4118 Author: freeipa-pr-ci Title: #4118: [testing_ipa-4.8] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4118/head:pr4118 git checkout pr4118

1 0

[freeipa PR#4096][opened] [testing_ipa-4.8] Nightly PR
by freeipa-pr-ci 11 Jan '20

11 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4096 Author: freeipa-pr-ci Title: #4096: [testing_ipa-4.8] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4096/head:pr4096 git checkout pr4096

1 1

[freeipa PR#4107][opened] [testing_master_latest] Nightly PR
by freeipa-pr-ci 10 Jan '20

10 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4107 Author: freeipa-pr-ci Title: #4107: [testing_master_latest] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4107/head:pr4107 git checkout pr4107

1 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel January 2020