pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0111-kerberos-session-use-CA-cert-with-full-cert-chain-fo.patch

ac7d03
From 1815435956746814362ddafca4f7a967e8886d90 Mon Sep 17 00:00:00 2001
ac7d03
From: Petr Vobornik <pvoborni@redhat.com>
ac7d03
Date: Tue, 25 Apr 2017 17:19:36 +0200
ac7d03
Subject: [PATCH] kerberos session: use CA cert with full cert chain for
ac7d03
 obtaining cookie
ac7d03
ac7d03
Http request performed in finalize_kerberos_acquisition doesn't use
ac7d03
CA certificate/certificate store with full certificate chain of IPA server.
ac7d03
So it might happen that in case that IPA is installed with externally signed
ac7d03
CA certificate, the call can fail because of certificate validation
ac7d03
and e.g. prevent session acquisition.
ac7d03
ac7d03
If it will fail for sure is not known - the use case was not discovered,
ac7d03
but it is faster and safer to fix preemptively.
ac7d03
ac7d03
https://pagure.io/freeipa/issue/6876
ac7d03
ac7d03
Reviewed-By: Martin Basti <mbasti@redhat.com>
ac7d03
---
ac7d03
 ipaserver/rpcserver.py | 3 ++-
ac7d03
 1 file changed, 2 insertions(+), 1 deletion(-)
ac7d03
ac7d03
diff --git a/ipaserver/rpcserver.py b/ipaserver/rpcserver.py
ac7d03
index 161872450d141a61af4345a20e278db728fe2aac..996a3d29884ca0180c39841f6986abf9b23ff13a 100644
ac7d03
--- a/ipaserver/rpcserver.py
ac7d03
+++ b/ipaserver/rpcserver.py
ac7d03
@@ -602,7 +602,8 @@ class KerberosSession(HTTP_Status):
ac7d03
         try:
ac7d03
             target = self.api.env.host
ac7d03
             r = requests.get('http://{0}/ipa/session/cookie'.format(target),
ac7d03
-                             auth=NegotiateAuth(target, ccache_name))
ac7d03
+                             auth=NegotiateAuth(target, ccache_name),
ac7d03
+                             verify=paths.IPA_CA_CRT)
ac7d03
             session_cookie = r.cookies.get("ipa_session")
ac7d03
             if not session_cookie:
ac7d03
                 raise ValueError('No session cookie found')
ac7d03
-- 
ac7d03
2.12.2
ac7d03