|
 |
ac7d03 |
From a6f958875f3b42a8ea5856b672f5e8416c0aad90 Mon Sep 17 00:00:00 2001
|
|
|
ac7d03 |
From: Martin Babinsky <mbabinsk@redhat.com>
|
|
|
ac7d03 |
Date: Fri, 31 Mar 2017 14:44:29 +0200
|
|
|
ac7d03 |
Subject: [PATCH] API for retrieval of master's PKINIT status and publishing it
|
|
|
ac7d03 |
in LDAP
|
|
|
ac7d03 |
|
|
|
ac7d03 |
An API was provided to report whether PKINIT is enabled for clients or
|
|
|
ac7d03 |
not. If yes, the pkinitEnabled value will be added to the
|
|
|
ac7d03 |
ipaConfigString attribute of master's KDC entry.
|
|
|
ac7d03 |
|
|
|
ac7d03 |
See http://www.freeipa.org/page/V4/Kerberos_PKINIT#Configuration for
|
|
|
ac7d03 |
more details.
|
|
|
ac7d03 |
|
|
|
ac7d03 |
https://pagure.io/freeipa/issue/6830
|
|
|
ac7d03 |
|
|
|
ac7d03 |
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
ac7d03 |
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
|
|
|
ac7d03 |
Reviewed-By: Martin Basti <mbasti@redhat.com>
|
|
|
ac7d03 |
Reviewed-By: Simo Sorce <ssorce@redhat.com>
|
|
|
ac7d03 |
---
|
|
|
ac7d03 |
ipaserver/install/krbinstance.py | 41 ++++++++++++++++++++++++++++++++++++++++
|
|
|
ac7d03 |
1 file changed, 41 insertions(+)
|
|
|
ac7d03 |
|
|
|
ac7d03 |
diff --git a/ipaserver/install/krbinstance.py b/ipaserver/install/krbinstance.py
|
|
|
ac7d03 |
index 80215788cf4031ef82e9ec7e08bde6cfc4390303..ad3475f95371c9ae17c8b0ac082039c041d5c64c 100644
|
|
|
ac7d03 |
--- a/ipaserver/install/krbinstance.py
|
|
|
ac7d03 |
+++ b/ipaserver/install/krbinstance.py
|
|
|
ac7d03 |
@@ -48,6 +48,38 @@ from ipaplatform.constants import constants
|
|
|
ac7d03 |
from ipaplatform.tasks import tasks
|
|
|
ac7d03 |
from ipaplatform.paths import paths
|
|
|
ac7d03 |
|
|
|
ac7d03 |
+PKINIT_ENABLED = 'pkinitEnabled'
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+def get_pkinit_request_ca():
|
|
|
ac7d03 |
+ """
|
|
|
ac7d03 |
+ Return the certmonger CA name which is serving the PKINIT certificate
|
|
|
ac7d03 |
+ request. If the certificate is not tracked by Certmonger, return None
|
|
|
ac7d03 |
+ """
|
|
|
ac7d03 |
+ pkinit_request_id = certmonger.get_request_id(
|
|
|
ac7d03 |
+ {'cert-file': paths.KDC_CERT})
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+ if pkinit_request_id is None:
|
|
|
ac7d03 |
+ return
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+ return certmonger.get_request_value(pkinit_request_id, 'ca-name')
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+def is_pkinit_enabled():
|
|
|
ac7d03 |
+ """
|
|
|
ac7d03 |
+ check whether PKINIT is enabled on the master by checking for the presence
|
|
|
ac7d03 |
+ of KDC certificate and it's tracking CA
|
|
|
ac7d03 |
+ """
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+ if os.path.exists(paths.KDC_CERT):
|
|
|
ac7d03 |
+ pkinit_request_ca = get_pkinit_request_ca()
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+ if pkinit_request_ca != "SelfSign":
|
|
|
ac7d03 |
+ return True
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+ return False
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
class KpasswdInstance(service.SimpleServiceInstance):
|
|
|
ac7d03 |
def __init__(self):
|
|
|
ac7d03 |
service.SimpleServiceInstance.__init__(self, "kadmin")
|
|
|
ac7d03 |
@@ -399,6 +431,13 @@ class KrbInstance(service.Service):
|
|
|
ac7d03 |
if prev_helper is not None:
|
|
|
ac7d03 |
certmonger.modify_ca_helper(certmonger_ca, prev_helper)
|
|
|
ac7d03 |
|
|
|
ac7d03 |
+ def pkinit_enable(self):
|
|
|
ac7d03 |
+ """
|
|
|
ac7d03 |
+ advertise enabled PKINIT feature in master's KDC entry in LDAP
|
|
|
ac7d03 |
+ """
|
|
|
ac7d03 |
+ service.set_service_entry_config(
|
|
|
ac7d03 |
+ 'KDC', self.fqdn, [PKINIT_ENABLED], self.suffix)
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
def issue_selfsigned_pkinit_certs(self):
|
|
|
ac7d03 |
self._call_certmonger(certmonger_ca="SelfSign")
|
|
|
ac7d03 |
# for self-signed certificate, the certificate is its own CA, copy it
|
|
|
ac7d03 |
@@ -410,6 +449,7 @@ class KrbInstance(service.Service):
|
|
|
ac7d03 |
self._call_certmonger()
|
|
|
ac7d03 |
# copy IPA CA bundle to the KDC's CA cert bundle
|
|
|
ac7d03 |
shutil.copyfile(paths.IPA_CA_CRT, paths.CACERT_PEM)
|
|
|
ac7d03 |
+ self.pkinit_enable()
|
|
|
ac7d03 |
except RuntimeError as e:
|
|
|
ac7d03 |
root_logger.error("PKINIT certificate request failed: %s", e)
|
|
|
ac7d03 |
root_logger.error("Failed to configure PKINIT")
|
|
|
ac7d03 |
@@ -427,6 +467,7 @@ class KrbInstance(service.Service):
|
|
|
ac7d03 |
# NOTE: this may not be the same set of CA certificates trusted by
|
|
|
ac7d03 |
# externally provided PKINIT cert.
|
|
|
ac7d03 |
shutil.copyfile(paths.IPA_CA_CRT, paths.CACERT_PEM)
|
|
|
ac7d03 |
+ self.pkinit_enable()
|
|
|
ac7d03 |
|
|
|
ac7d03 |
def setup_pkinit(self):
|
|
|
ac7d03 |
if self.pkcs12_info:
|
|
|
ac7d03 |
--
|
|
|
ac7d03 |
2.12.2
|
|
|
ac7d03 |
|