pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0063-Add-permission-for-bypassing-CA-ACL-enforcement.patch

590d18
From 61487ce8cbcad43a711931e92c3c2ef9b160cc02 Mon Sep 17 00:00:00 2001
590d18
From: Fraser Tweedale <ftweedal@redhat.com>
590d18
Date: Tue, 4 Aug 2015 01:13:09 -0400
590d18
Subject: [PATCH] Add permission for bypassing CA ACL enforcement
590d18
590d18
Add the "Request Certificate ignoring CA ACLs" permission and
590d18
associated ACI, initially assigned to "Certificate Administrators"
590d18
privilege.
590d18
590d18
Update cert-request command to skip CA ACL enforcement when the bind
590d18
principal has this permission.
590d18
590d18
Fixes: https://fedorahosted.org/freeipa/ticket/5099
590d18
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
590d18
---
590d18
 install/updates/40-delegation.update | 15 +++++++++++++++
590d18
 ipalib/plugins/cert.py               | 13 ++++++++++---
590d18
 2 files changed, 25 insertions(+), 3 deletions(-)
590d18
590d18
diff --git a/install/updates/40-delegation.update b/install/updates/40-delegation.update
590d18
index bc0736c5b6c07747586a56c2cbde9596c7522d1c..8d4f6296cbed7fcc968c2193022cb50b488c8561 100644
590d18
--- a/install/updates/40-delegation.update
590d18
+++ b/install/updates/40-delegation.update
590d18
@@ -144,6 +144,21 @@ default:member: cn=Certificate Administrators,cn=privileges,cn=pbac,$SUFFIX
590d18
 dn: $SUFFIX
590d18
 add:aci:(targetattr = "objectclass")(target = "ldap:///cn=request certificate with subjectaltname,cn=virtual operations,cn=etc,$SUFFIX" )(version 3.0; acl "permission:Request Certificate with SubjectAltName"; allow (write) groupdn = "ldap:///cn=Request Certificate with SubjectAltName,cn=permissions,cn=pbac,$SUFFIX";)
590d18
 
590d18
+dn: cn=request certificate ignore caacl,cn=virtual operations,cn=etc,$SUFFIX
590d18
+default:objectClass: top
590d18
+default:objectClass: nsContainer
590d18
+default:cn: request certificate ignore caacl
590d18
+
590d18
+dn: cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,$SUFFIX
590d18
+default:objectClass: top
590d18
+default:objectClass: groupofnames
590d18
+default:objectClass: ipapermission
590d18
+default:cn: Request Certificate ignoring CA ACLs
590d18
+default:member: cn=Certificate Administrators,cn=privileges,cn=pbac,$SUFFIX
590d18
+
590d18
+dn: $SUFFIX
590d18
+add:aci:(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,$SUFFIX" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,$SUFFIX";)
590d18
+
590d18
 
590d18
 # Read privileges
590d18
 dn: cn=RBAC Readers,cn=privileges,cn=pbac,$SUFFIX
590d18
diff --git a/ipalib/plugins/cert.py b/ipalib/plugins/cert.py
590d18
index 610f2149363eaa74180e9de5c9ee1439446ef409..daa698b54f2cc1b645245d312fae0f0500239ea2 100644
590d18
--- a/ipalib/plugins/cert.py
590d18
+++ b/ipalib/plugins/cert.py
590d18
@@ -345,8 +345,6 @@ class cert_request(VirtualCommand):
590d18
         else:
590d18
             principal_type = SERVICE
590d18
 
590d18
-        caacl_check(principal_type, principal_string, ca, profile_id)
590d18
-
590d18
         bind_principal = split_any_principal(getattr(context, 'principal'))
590d18
         bind_service, bind_name, bind_realm = bind_principal
590d18
 
590d18
@@ -362,6 +360,15 @@ class cert_request(VirtualCommand):
590d18
             self.check_access()
590d18
 
590d18
         try:
590d18
+            self.check_access("request certificate ignore caacl")
590d18
+            bypass_caacl = True
590d18
+        except errors.ACIError:
590d18
+            bypass_caacl = False
590d18
+
590d18
+        if not bypass_caacl:
590d18
+            caacl_check(principal_type, principal_string, ca, profile_id)
590d18
+
590d18
+        try:
590d18
             subject = pkcs10.get_subject(csr)
590d18
             extensions = pkcs10.get_extensions(csr)
590d18
             subjectaltname = pkcs10.get_subjectaltname(csr) or ()
590d18
@@ -469,7 +476,7 @@ class cert_request(VirtualCommand):
590d18
                         raise errors.ACIError(info=_(
590d18
                             "Insufficient privilege to create a certificate "
590d18
                             "with subject alt name '%s'.") % name)
590d18
-                if alt_principal_string is not None:
590d18
+                if alt_principal_string is not None and not bypass_caacl:
590d18
                     caacl_check(
590d18
                         principal_type, alt_principal_string, ca, profile_id)
590d18
             elif name_type in (pkcs10.SAN_OTHERNAME_KRB5PRINCIPALNAME,
590d18
-- 
590d18
2.4.3
590d18