diff --git a/SOURCES/pki-core-rhel-7-9-rhcs-9-7-bu-7.patch b/SOURCES/pki-core-rhel-7-9-rhcs-9-7-bu-7.patch new file mode 100644 index 0000000..12de0fa --- /dev/null +++ b/SOURCES/pki-core-rhel-7-9-rhcs-9-7-bu-7.patch @@ -0,0 +1,114 @@ +From f5549f8c760035bc15d88109dfd947e91c5bf1e9 Mon Sep 17 00:00:00 2001 +From: Christina Fu +Date: Mon, 7 Jun 2021 11:23:03 -0700 +Subject: [PATCH] Bug1905374 restrict EE profile list and enrollment submission + per LDAP group without immediate issuance + +It's always been the case by design that if authentication (auth.instance_id=X) is specified in a profile, then as long as a request passes both authentication and authorization (authz.Y) then the issuance would be granted. +In this patch, an option per profile is added to override such design and would require explicit agent approval even when both auth and authz passed. + +This new option is auth.explicitApprovalRequired and the value is true +or false,with false being the default if not set. + +An example configuration in a directory-based authentication profile +would have something like the following: + + auth.instance_id=UserDirEnrollment + auth.explicitApprovalRequired=true + authz.acl=group=requestors + +addressed https://bugzilla.redhat.com/show_bug.cgi?id=1905374 + +(cherry picked from commit 8e78a2b912e7c3bd015e4da1f1630d0f35145104) +--- + .../src/com/netscape/certsrv/profile/IProfile.java | 2 ++ + .../netscape/cms/profile/common/EnrollProfile.java | 21 +++++++++++++++++++-- + .../netscape/cms/servlet/cert/CertProcessor.java | 6 +++++- + 3 files changed, 26 insertions(+), 3 deletions(-) + +diff --git a/base/common/src/com/netscape/certsrv/profile/IProfile.java b/base/common/src/com/netscape/certsrv/profile/IProfile.java +index b4605cf..e076232 100644 +--- a/base/common/src/com/netscape/certsrv/profile/IProfile.java ++++ b/base/common/src/com/netscape/certsrv/profile/IProfile.java +@@ -424,6 +424,8 @@ public interface IProfile { + */ + public void submit(IAuthToken token, IRequest request) + throws EDeferException, EProfileException; ++ public void submit(IAuthToken token, IRequest request, boolean explicitApprovalRequired) ++ throws EDeferException, EProfileException; + + public void setRenewal(boolean renewal); + +diff --git a/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java b/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java +index b7fdb9e..afcfa0d 100644 +--- a/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java ++++ b/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java +@@ -518,6 +518,10 @@ public abstract class EnrollProfile extends BasicProfile + */ + public void submit(IAuthToken token, IRequest request) + throws EDeferException, EProfileException { ++ submit(token, request, false); ++ } ++ public void submit(IAuthToken token, IRequest request, boolean explicitApprovalRequired) ++ throws EDeferException, EProfileException { + // Request Submission Logic: + // + // if (Authentication Failed) { +@@ -549,8 +553,21 @@ public abstract class EnrollProfile extends BasicProfile + CMS.debug(e); + } + +- if (token == null){ +- CMS.debug(method + " auth token is null; agent manual approval required;"); ++ /* ++ * this is where we decide whether to let agent do manual approval ++ * or not ++ * If auth.instance_id is not set, then request automatically goes ++ * into queue for agent approval. ++ * If auth.explicitApprovalRequired is true, then the request goes into ++ * queue for agent approval even though auth and authz succeed. ++ */ ++ if ((token == null) || (explicitApprovalRequired == true)){ ++ ++ if (token == null) ++ CMS.debug(method + " auth token is null; agent manual approval required;"); ++ else ++ CMS.debug(method + "explicitApprovalRequired is true; agent manual approval required"); ++ + CMS.debug(method + " validating request"); + validate(request); + try { +diff --git a/base/server/cms/src/com/netscape/cms/servlet/cert/CertProcessor.java b/base/server/cms/src/com/netscape/cms/servlet/cert/CertProcessor.java +index 6252e6e..b9eda7c 100644 +--- a/base/server/cms/src/com/netscape/cms/servlet/cert/CertProcessor.java ++++ b/base/server/cms/src/com/netscape/cms/servlet/cert/CertProcessor.java +@@ -31,6 +31,7 @@ import com.netscape.certsrv.authentication.ExternalAuthToken; + import com.netscape.certsrv.authentication.IAuthToken; + import com.netscape.certsrv.base.EBaseException; + import com.netscape.certsrv.base.EPropertyNotFound; ++import com.netscape.certsrv.base.IConfigStore; + import com.netscape.certsrv.cert.CertEnrollmentRequest; + import com.netscape.certsrv.logging.ILogger; + import com.netscape.certsrv.logging.event.CertRequestProcessedEvent; +@@ -224,6 +225,9 @@ public class CertProcessor extends CAProcessor { + + for (IRequest req : reqs) { + try { ++ IConfigStore profileConf = profile.getConfigStore().getSubStore("auth"); ++ boolean explicitApprovalRequired = profileConf.getBoolean("explicitApprovalRequired", false); ++ + // reset the "auditRequesterID" + auditRequesterID = auditRequesterID(req); + +@@ -242,7 +246,7 @@ public class CertProcessor extends CAProcessor { + */ + + CMS.debug("CertProcessor.submitRequest: calling profile submit"); +- profile.submit(authToken, req); ++ profile.submit(authToken, req, explicitApprovalRequired); + req.setRequestStatus(RequestStatus.COMPLETE); + + X509CertImpl x509cert = req.getExtDataInCert(IEnrollProfile.REQUEST_ISSUED_CERT); +-- +1.8.3.1 + diff --git a/SPECS/pki-core.spec b/SPECS/pki-core.spec index 452f790..6e8a5f7 100644 --- a/SPECS/pki-core.spec +++ b/SPECS/pki-core.spec @@ -65,13 +65,13 @@ Name: pki-core %if 0%{?rhel} Version: 10.5.18 -%define redhat_release 14 +%define redhat_release 15 %define redhat_stage 0 #%define default_release %{redhat_release}.%{redhat_stage} %define default_release %{redhat_release} %else Version: 10.5.18 -%define fedora_release 14 +%define fedora_release 15 %define fedora_stage 0 #%define default_release %{fedora_release}.%{fedora_stage} %define default_release %{fedora_release} @@ -219,6 +219,7 @@ Patch9: pki-core-rhel-7-9-rhcs-9-7-bu-4.patch Patch10: pki-core-Change-var-TPS-to-tps.patch Patch11: pki-core-rhel-7-9-rhcs-9-7-bu-6.0.patch Patch12: pki-core-rhel-7-9-rhcs-9-7-bu-6.1.patch +Patch13: pki-core-rhel-7-9-rhcs-9-7-bu-7.patch # Obtain version phase number (e. g. - used by "alpha", "beta", etc.) # @@ -832,6 +833,7 @@ This package is a part of the PKI Core used by the Certificate System. %patch10 -p1 %patch11 -p1 %patch12 -p1 +%patch13 -p1 %clean %{__rm} -rf %{buildroot} @@ -1369,6 +1371,18 @@ fi %endif # %{with server} %changelog +* Fri Jun 25 2021 Dogtag Team 10.5.18-15 +- ########################################################################## +- # RHEL 7.9: +- ########################################################################## +- Bugzilla Bug 1905374 - restrict EE profile list and enrollment submission + per LDAP group without immediate issuance [rhel-7.9.z] (cfu) +- ########################################################################## +- # RHCS 9.7: +- ########################################################################## +- Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and + pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7) + * Thu May 13 2021 Dogtag Team 10.5.18-14 - ########################################################################## - # RHEL 7.9: