|
 |
ac7d03 |
From 1815435956746814362ddafca4f7a967e8886d90 Mon Sep 17 00:00:00 2001
|
|
|
ac7d03 |
From: Petr Vobornik <pvoborni@redhat.com>
|
|
|
ac7d03 |
Date: Tue, 25 Apr 2017 17:19:36 +0200
|
|
|
ac7d03 |
Subject: [PATCH] kerberos session: use CA cert with full cert chain for
|
|
|
ac7d03 |
obtaining cookie
|
|
|
ac7d03 |
|
|
|
ac7d03 |
Http request performed in finalize_kerberos_acquisition doesn't use
|
|
|
ac7d03 |
CA certificate/certificate store with full certificate chain of IPA server.
|
|
|
ac7d03 |
So it might happen that in case that IPA is installed with externally signed
|
|
|
ac7d03 |
CA certificate, the call can fail because of certificate validation
|
|
|
ac7d03 |
and e.g. prevent session acquisition.
|
|
|
ac7d03 |
|
|
|
ac7d03 |
If it will fail for sure is not known - the use case was not discovered,
|
|
|
ac7d03 |
but it is faster and safer to fix preemptively.
|
|
|
ac7d03 |
|
|
|
ac7d03 |
https://pagure.io/freeipa/issue/6876
|
|
|
ac7d03 |
|
|
|
ac7d03 |
Reviewed-By: Martin Basti <mbasti@redhat.com>
|
|
|
ac7d03 |
---
|
|
|
ac7d03 |
ipaserver/rpcserver.py | 3 ++-
|
|
|
ac7d03 |
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
ac7d03 |
|
|
|
ac7d03 |
diff --git a/ipaserver/rpcserver.py b/ipaserver/rpcserver.py
|
|
|
ac7d03 |
index 161872450d141a61af4345a20e278db728fe2aac..996a3d29884ca0180c39841f6986abf9b23ff13a 100644
|
|
|
ac7d03 |
--- a/ipaserver/rpcserver.py
|
|
|
ac7d03 |
+++ b/ipaserver/rpcserver.py
|
|
|
ac7d03 |
@@ -602,7 +602,8 @@ class KerberosSession(HTTP_Status):
|
|
|
ac7d03 |
try:
|
|
|
ac7d03 |
target = self.api.env.host
|
|
|
ac7d03 |
r = requests.get('http://{0}/ipa/session/cookie'.format(target),
|
|
|
ac7d03 |
- auth=NegotiateAuth(target, ccache_name))
|
|
|
ac7d03 |
+ auth=NegotiateAuth(target, ccache_name),
|
|
|
ac7d03 |
+ verify=paths.IPA_CA_CRT)
|
|
|
ac7d03 |
session_cookie = r.cookies.get("ipa_session")
|
|
|
ac7d03 |
if not session_cookie:
|
|
|
ac7d03 |
raise ValueError('No session cookie found')
|
|
|
ac7d03 |
--
|
|
|
ac7d03 |
2.12.2
|
|
|
ac7d03 |
|