freeipa

#3473 Switch to using RESTful interface in dogtag CA interface
Opened by rcritten. Modified

Open
Close Issue

We currently do xml-like/javascript-ish requests and parsing to dogtag. dogtag 10 introduced a new RESTful API that should use instead. This provides a much cleaner interface and will require a lot less post-request processing on our side.

The pki tool can be used to model the capabilities.

From an end-user perspective nothing should change, this is all internal API work.

Documentation: ​http://pki.fedoraproject.org/wiki/REST#Current_Implementation

Duplicate ticket: #4004. We should rescope this change.

Starting to shape next release

Discussed with Fraser, this may be just natural part of the subCA work (#4559).

This work can wait - 4.2 is almost out of the door, no time for refactoring.

When switching, jcholast realized we should also move certmonger dogtag backend to REST interface. This will make it require Dogtag 10+, but I do not think there is many Dogtag 9 servers out there (except RHEL-6/CentOS-6 based ones).

This ticket is out of scope of 4.4.0 release. Moving to 4.4.1. Note that 4.4.1 needs to be triaged, therefore not everything will be implemented.

ipa-4-4:

  • faa98882d9db3c2275d4dbf9040b6e048537c5f4 Allow Dogtag RestClient to perform requests without logging in
  • d812675635e0399a252a9a251695df6217d7f013 Add HTTPRequestError class
  • dd5ed21c19aa884eb7dbf7b9ec8b0ce77e458571 Use Dogtag REST API for certificate requests

master:

  • 2a42a7e90eb8154a6722ae93d93f8cf6796f4a21 Allow Dogtag RestClient to perform requests without logging in
  • c5cbc8de89c7d88c443bff937fe9aa965e4c1c94 Add HTTPRequestError class
  • 4c35afccf3cf3a5176e598872c4fcff80b416335 Use Dogtag REST API for certificate requests

Aforementioned commits only address this ticket in part.
There are several more functions to be migrated to Dogtag REST API.

Reopening ticket.

Moving to next major version. Fixing this bug is not critical in stabilization release.

For cert retrieval to move to REST API, we depend on upstream
change: https://fedorahosted.org/pki/ticket/2601

Metadata Update from @rcritten:
- Issue assigned to ftweedal
- Issue set to the milestone: FreeIPA 4.5

master:

  • 49f87f34be5f04f18a6d916276153e9ef1e5852c dogtag: remove redundant property definition

master:

  • 49f87f34be5f04f18a6d916276153e9ef1e5852c dogtag: remove redundant property definition

master:

  • 3ba0375c831eca673c2df146b565a32dbc03fdb3 rabase.get_certificate: make serial number arg mandatory

Metadata Update from @mbasti:
- Issue set to the milestone: FreeIPA 4.5.1 (was: FreeIPA 4.5)

Some ground work landed in 4.4 and 4.5 milestones, but the whole task is not finished. Moving to 4.7 - next major.

Metadata Update from @pvoborni:
- Issue set to the milestone: FreeIPA 4.7 (was: FreeIPA 4.5.1)

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.7.1 (was: FreeIPA 4.7)

FreeIPA 4.7 has been released, moving to FreeIPA 4.7.1 milestone

master:

  • d7f3a0b2d31fe3a02a19286d590cf1a343458fd8 ra.get_certificate: use REST API

Metadata Update from @rcritten:
- Issue assigned to rcritten (was: ftweedal)
- Issue set to the milestone: None (was: FreeIPA 4.7.1)

Closed https://pagure.io/freeipa/issue/9345 as a duplicate
Metadata
None
None
None
Normal
refactoring
Certificate management
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.