freeipa

#7036 Advice plugins for smart card configuration produce scripts that configure the feature incompletely
Closed: fixed Opened by mbabinsk.

Closed: fixed
Reopen Issue

The config-{client,server}-for-smart-card-auth recipes do not perform all the necessary steps required for successful configuration of Smart Card authentication on server and client, namely:

  • support for specifying multiple smart card signing CA certificates
  • uploading signing CA certificates to IPA certstore and relevant CA bundles (so that Kerberos client library will use them as PKINIT anchors)
  • uploading signing CA certificates to systemwide trust store

The plugins should be fixed to generate scripts that implement this additional functionality on both server and client.

Metadata Update from @mbabinsk:
- Issue assigned to mbabinsk

Metadata Update from @mbabinsk:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1455946

Metadata Update from @mbabinsk:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1455946

Issue linked to Bugzilla: Bug 1455946

Metadata Update from @mbasti:
- Issue set to the milestone: FreeIPA 4.5.3

master:

  • 69ba5f942284d17f32650638965c21dcf907a579 smart-card advises: configure systemwide NSS DB also on master
  • 584abe5b68b74d6a4721525328d5dfadd0e092c0 smart-card advises: add steps to store smart card signing CA cert
  • e0c2e0f26cc264dccc51295cdd595109b4e46392 Allow to pass in multiple CA cert paths to the smart card advises
  • 36e0d2d65cf19033b1022737cd24a1120bc0f85f add a class that tracks the indentation in the generated advises
  • 0181334c4c8e4b73b9b1c634d9837857e5e388b8 delegate the indentation handling in advises to dedicated class
  • dea4b4ca1bebf128a9a2e26dbbe9ffd3d6f360e1 advise: add an infrastructure for formatting Bash compound statements
  • 9808395c17388d69b51e562bc7f2b1d7d172a7fb delegate formatting of compound Bash statements to dedicated classes
  • 85a79b5ccd29a532f7e3f0f17b9ba08153bf9717 Fix indentation of statements in Smart card advises
  • a9fec090f7a50e6f53394cab1cc5929c18934ac0 Use the compound statement formatting API for configuring PKINIT
  • 4d57aef7a50eeae04bbd117531808ac616c675eb smart card advises: use a wrapper around Bash for loops
  • e0cf7090f3869bc3d4673242f64d63011dc8d1a5 smart card advise: use password when changing trust flags on HTTP cert
  • 53c5c0ad7bde137b1123504f6a52c2b22e2a3868 smart-card-advises: ensure that krb5-pkinit is installed on client

ipa-4-5:

  • 23917c71f72ba899054bc5dc72c36d5308ead94c smart-card advises: configure systemwide NSS DB also on master
  • ef2ab942d2dee4a7a902f70a7eaf1c35cf88bee6 smart-card advises: add steps to store smart card signing CA cert
  • 3ebab27ded06a72d807c10b1ba521c6406df1ab4 Allow to pass in multiple CA cert paths to the smart card advises
  • e5f31e35d3d17b5871cb39ebe55b413ba0dca489 add a class that tracks the indentation in the generated advises
  • 9561e3f8a2be66c1c236ac7fe296a8c8cbbac5c1 delegate the indentation handling in advises to dedicated class
  • 666c2da3afcc461870d423409db4298e7ead6493 advise: add an infrastructure for formatting Bash compound statements
  • 2be45a1d95b7033ee25a643fdd74f5f30c41fea5 delegate formatting of compound Bash statements to dedicated classes
  • 61f6cb7e6fa632db08628534c512a22e35682dc1 Fix indentation of statements in Smart card advises
  • 08f56c3c8ccde61146baec16085b325726582752 Use the compound statement formatting API for configuring PKINIT
  • e5e4c0a484412e11cc414ca80dc230b0000c00d7 smart card advises: use a wrapper around Bash for loops
  • e14194e171be82d43ad16b4a585502a9c28aace3 smart card advise: use password when changing trust flags on HTTP cert
  • 1114e113d5cc558f13398af8bc5a179b33f9354b smart-card-advises: ensure that krb5-pkinit is installed on client

Metadata Update from @mbasti:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.