|
 |
8558a7 |
From 6d813f6b03811a285c3c6dae85942c0086b619a6 Mon Sep 17 00:00:00 2001
|
|
|
8558a7 |
From: Nathaniel McCallum <npmccallum@redhat.com>
|
|
|
8558a7 |
Date: Mon, 26 Feb 2018 09:48:22 -0500
|
|
|
8558a7 |
Subject: [PATCH] Revert "Don't allow OTP or RADIUS in FIPS mode"
|
|
|
8558a7 |
|
|
|
8558a7 |
This reverts commit 16a952a0a44a0ebee97029ea1d2f6b7593dd2622.
|
|
|
8558a7 |
|
|
|
8558a7 |
OTP now works in FIPS mode. RADIUS can be made to be compliant by wrapping
|
|
|
8558a7 |
traffic in a VPN.
|
|
|
8558a7 |
|
|
|
8558a7 |
https://pagure.io/freeipa/issue/7168
|
|
|
8558a7 |
https://pagure.io/freeipa/issue/7243
|
|
|
8558a7 |
|
|
|
8558a7 |
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
|
|
|
8558a7 |
Reviewed-By: Christian Heimes <cheimes@redhat.com>
|
|
|
8558a7 |
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
|
|
|
8558a7 |
---
|
|
|
8558a7 |
ipaserver/plugins/baseuser.py | 3 ---
|
|
|
8558a7 |
ipaserver/plugins/config.py | 16 ----------------
|
|
|
8558a7 |
2 files changed, 19 deletions(-)
|
|
|
8558a7 |
|
|
|
8558a7 |
diff --git a/ipaserver/plugins/baseuser.py b/ipaserver/plugins/baseuser.py
|
|
|
8558a7 |
index bb8a73ded0fed135d5829ec0b0829a936f2196fb..bf24dbf542d3b481671dfe4e8cee14a2edcc26e0 100644
|
|
|
8558a7 |
--- a/ipaserver/plugins/baseuser.py
|
|
|
8558a7 |
+++ b/ipaserver/plugins/baseuser.py
|
|
|
8558a7 |
@@ -32,7 +32,6 @@ from .baseldap import (
|
|
|
8558a7 |
add_missing_object_class)
|
|
|
8558a7 |
from ipaserver.plugins.service import (
|
|
|
8558a7 |
validate_certificate, validate_realm, normalize_principal)
|
|
|
8558a7 |
-from ipaserver.plugins.config import check_fips_auth_opts
|
|
|
8558a7 |
from ipalib.request import context
|
|
|
8558a7 |
from ipalib import _
|
|
|
8558a7 |
from ipalib.constants import PATTERN_GROUPUSER_NAME
|
|
|
8558a7 |
@@ -478,7 +477,6 @@ class baseuser_add(LDAPCreate):
|
|
|
8558a7 |
**options):
|
|
|
8558a7 |
assert isinstance(dn, DN)
|
|
|
8558a7 |
set_krbcanonicalname(entry_attrs)
|
|
|
8558a7 |
- check_fips_auth_opts(fips_mode=self.api.env.fips_mode, **options)
|
|
|
8558a7 |
self.obj.convert_usercertificate_pre(entry_attrs)
|
|
|
8558a7 |
|
|
|
8558a7 |
def post_common_callback(self, ldap, dn, entry_attrs, *keys, **options):
|
|
|
8558a7 |
@@ -602,7 +600,6 @@ class baseuser_mod(LDAPUpdate):
|
|
|
8558a7 |
assert isinstance(dn, DN)
|
|
|
8558a7 |
add_sshpubkey_to_attrs_pre(self.context, attrs_list)
|
|
|
8558a7 |
|
|
|
8558a7 |
- check_fips_auth_opts(fips_mode=self.api.env.fips_mode, **options)
|
|
|
8558a7 |
self.check_namelength(ldap, **options)
|
|
|
8558a7 |
|
|
|
8558a7 |
self.check_mail(entry_attrs)
|
|
|
8558a7 |
diff --git a/ipaserver/plugins/config.py b/ipaserver/plugins/config.py
|
|
|
8558a7 |
index c9033fa8e7a2a0bfe77464fa4f9c62278bd814f6..ce15e6096f5b84dc45ee21d5aecc73ecf86eba07 100644
|
|
|
8558a7 |
--- a/ipaserver/plugins/config.py
|
|
|
8558a7 |
+++ b/ipaserver/plugins/config.py
|
|
|
8558a7 |
@@ -85,20 +85,6 @@ EXAMPLES:
|
|
|
8558a7 |
|
|
|
8558a7 |
register = Registry()
|
|
|
8558a7 |
|
|
|
8558a7 |
-
|
|
|
8558a7 |
-def check_fips_auth_opts(fips_mode, **options):
|
|
|
8558a7 |
- """
|
|
|
8558a7 |
- OTP and RADIUS are not allowed in FIPS mode since they use MD5
|
|
|
8558a7 |
- checksums (OTP uses our RADIUS responder daemon ipa-otpd).
|
|
|
8558a7 |
- """
|
|
|
8558a7 |
- if 'ipauserauthtype' in options and fips_mode:
|
|
|
8558a7 |
- if ('otp' in options['ipauserauthtype'] or
|
|
|
8558a7 |
- 'radius' in options['ipauserauthtype']):
|
|
|
8558a7 |
- raise errors.InvocationError(
|
|
|
8558a7 |
- 'OTP and RADIUS authentication in FIPS is '
|
|
|
8558a7 |
- 'not yet supported')
|
|
|
8558a7 |
-
|
|
|
8558a7 |
-
|
|
|
8558a7 |
@register()
|
|
|
8558a7 |
class config(LDAPObject):
|
|
|
8558a7 |
"""
|
|
|
8558a7 |
@@ -412,8 +398,6 @@ class config_mod(LDAPUpdate):
|
|
|
8558a7 |
|
|
|
8558a7 |
def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
|
|
|
8558a7 |
assert isinstance(dn, DN)
|
|
|
8558a7 |
- check_fips_auth_opts(fips_mode=self.api.env.fips_mode, **options)
|
|
|
8558a7 |
-
|
|
|
8558a7 |
if 'ipadefaultprimarygroup' in entry_attrs:
|
|
|
8558a7 |
group=entry_attrs['ipadefaultprimarygroup']
|
|
|
8558a7 |
try:
|
|
|
8558a7 |
--
|
|
|
8558a7 |
2.14.3
|
|
|
8558a7 |
|