freeipa

#7145 ca_certfile is not honored on API requests
Closed: fixed Opened by rcritten.

Closed: fixed
Reopen Issue

The location of the CA chain can be specified by setting ca_certfile in RPCClient::create_connection. This value is properly saved in the context but when the actual connection is made in SSLTransport the hardcoded value in the API is used instead of the value in the context.

This can be worked around by setting tls_ca_cert in api.bootstrap() but it shouldn't be necessary given the variable is already there.

Also of note if the CA file does not exist then only "Unhandled exception: [Errno 2] No such file or directory" is provided, not what file cannot be found.

PR https://github.com/freeipa/freeipa/pull/1047

The reason I need this is to be able to do IPA operations on a machine that is not enrolled as an IPA client. I create a temporary krb5.conf and bootstrap IPA In such a way that I don't need to be enrolled. To do this I need to fetch the CA chain and pass it into the rpcclient class. This can be done one of two ways:

  • by setting api.env.tls_ca_cert during bootstrap which would affect all subsequent connections which may not be desirable
  • or by actually using the value set when the connection is created as was originally designed

Metadata Update from @pvoborni:
- Issue priority set to: major
- Issue set to the milestone: FreeIPA 4.5.4

Metadata Update from @tkrizek:
- Issue set to the milestone: FreeIPA 4.5.5 (was: FreeIPA 4.5.4)

master:

  • 17bda0b1a532ff2ac8503187e2d6e648f63d427f Use the CA chain file from the RPC context
  • e8a26afb94e57ce08efad60ed9684bc58b9b1c58 Add test to ensure that properties are being set in rpcclient
  • 01bfe2247e2297e9e0a55fb1baa0078525747c33 If the cafile is not present or readable then raise an exception

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-6:

  • 806b76b650da1d2b7c2fe135dfe3691355e1e849 Use the CA chain file from the RPC context
  • cd0066a5de7bb58e0169917ec4eeb6d4b96055cf Add test to ensure that properties are being set in rpcclient
  • 6273ec612b1318fbab2208b39d5855909c38e983 If the cafile is not present or readable then raise an exception
Metadata
None
None
None
None
Normal
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.