|
 |
ac7d03 |
From 37ddd26bc4b2f99dfa27b2ad45219290a2f44ec5 Mon Sep 17 00:00:00 2001
|
|
|
ac7d03 |
From: Jan Cholasta <jcholast@redhat.com>
|
|
|
ac7d03 |
Date: Fri, 7 Apr 2017 07:46:58 +0200
|
|
|
ac7d03 |
Subject: [PATCH] renew agent: revert to host keytab authentication
|
|
|
ac7d03 |
|
|
|
ac7d03 |
Fixes an issue where the renew agent uses GSSAPI for LDAP connection but
|
|
|
ac7d03 |
fails because it is not authenticated.
|
|
|
ac7d03 |
|
|
|
ac7d03 |
This reverts commit 7462adec13c5b25b6868d2863dc38062c97d0ff7.
|
|
|
ac7d03 |
|
|
|
ac7d03 |
https://pagure.io/freeipa/issue/6757
|
|
|
ac7d03 |
|
|
|
ac7d03 |
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
|
|
|
ac7d03 |
---
|
|
|
ac7d03 |
install/certmonger/dogtag-ipa-ca-renew-agent-submit | 8 +++++++-
|
|
|
ac7d03 |
1 file changed, 7 insertions(+), 1 deletion(-)
|
|
|
ac7d03 |
|
|
|
ac7d03 |
diff --git a/install/certmonger/dogtag-ipa-ca-renew-agent-submit b/install/certmonger/dogtag-ipa-ca-renew-agent-submit
|
|
|
ac7d03 |
index 5782db703c49d7c2e92c806e24e9925e8e7d710a..3389447a99d9ab9dac159b0d57ca02f60698ce0c 100755
|
|
|
ac7d03 |
--- a/install/certmonger/dogtag-ipa-ca-renew-agent-submit
|
|
|
ac7d03 |
+++ b/install/certmonger/dogtag-ipa-ca-renew-agent-submit
|
|
|
ac7d03 |
@@ -40,6 +40,7 @@ from cryptography.hazmat.backends import default_backend
|
|
|
ac7d03 |
|
|
|
ac7d03 |
import six
|
|
|
ac7d03 |
|
|
|
ac7d03 |
+from ipalib.install.kinit import kinit_keytab
|
|
|
ac7d03 |
from ipapython import ipautil
|
|
|
ac7d03 |
from ipapython.dn import DN
|
|
|
ac7d03 |
from ipalib import api, errors, x509
|
|
|
ac7d03 |
@@ -132,7 +133,7 @@ def ldap_connect():
|
|
|
ac7d03 |
conn = None
|
|
|
ac7d03 |
try:
|
|
|
ac7d03 |
conn = ldap2(api)
|
|
|
ac7d03 |
- conn.connect(autobind=True)
|
|
|
ac7d03 |
+ conn.connect(ccache=os.environ['KRB5CCNAME'])
|
|
|
ac7d03 |
yield conn
|
|
|
ac7d03 |
finally:
|
|
|
ac7d03 |
if conn is not None and conn.isconnected():
|
|
|
ac7d03 |
@@ -526,6 +527,11 @@ def main():
|
|
|
ac7d03 |
tmpdir = tempfile.mkdtemp(prefix="tmp-")
|
|
|
ac7d03 |
certs.renewal_lock.acquire()
|
|
|
ac7d03 |
try:
|
|
|
ac7d03 |
+ principal = str('host/%s@%s' % (api.env.host, api.env.realm))
|
|
|
ac7d03 |
+ ccache_filename = os.path.join(tmpdir, 'ccache')
|
|
|
ac7d03 |
+ os.environ['KRB5CCNAME'] = ccache_filename
|
|
|
ac7d03 |
+ kinit_keytab(principal, paths.KRB5_KEYTAB, ccache_filename)
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
profile = os.environ.get('CERTMONGER_CA_PROFILE')
|
|
|
ac7d03 |
if is_replicated():
|
|
|
ac7d03 |
if profile or is_renewal_master():
|
|
|
ac7d03 |
--
|
|
|
ac7d03 |
2.9.3
|
|
|
ac7d03 |
|