Bug 1388622

Summary:	FreeIPA to Dogtag permission mapping plugin
Product:	Red Hat Enterprise Linux 7	Reporter:	Matthew Harmsen <mharmsen>
Component:	pki-core	Assignee:	Fraser Tweedale <ftweedal>
Status:	CLOSED ERRATA	QA Contact:	Asha Akkiangady <aakkiang>
Severity:	unspecified	Docs Contact:	Marc Muehlfeld <mmuehlfe>
Priority:	medium
Version:	7.3	CC:	arubin, ftweedal, gkapoor
Target Milestone:	rc
Target Release:	7.4
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	pki-core-10.4.1-1.el7, pki-core-10.4.1-1.el7.pki	Doc Type:	Enhancement
Doc Text:	The "searchBase" configuration option has been added to the DirAclAuthz PKI Server plug-in To support reading different sets of authorization access control lists (ACL), the "searchBase" configuration option has been added to the DirAclAuthz PKI Server plug-in. As a result, you can set the sub-tree from which the plug-in loads ACLs.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-01 22:48:25 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Matthew Harmsen 2016-10-25 18:59:42 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/pki/ticket/2525

Support for GSS-API authentication (or other external authentication
where principal name and groups/permission are supplied in request
environment) entails the creation of an authorization plugin that can
knows how to map gropus/permissions defined by the external IdM system
(e.g. FreeIPA) to Dogtag operations.

Comment 1 Matthew Harmsen 2016-10-25 19:03:17 UTC

Per PKI Bug Council of 10/25/2016: 7.4 - critical

Verify as a part of the test plan (will be verified as a part of FreeIPA and potentially Dogtag).

Instructions will be documented per the following Wiki ticket:
* https://fedorahosted.org/pki/ticket/2528 - [WIKI] Document use of FreeIPA-to-Dogtag authorization plug-in

Comment 2 Fraser Tweedale 2017-04-07 01:38:27 UTC

This was committed to upstream:
76266bbf9b48f0ff01e7bfc9cd114c7ced460256

And is in the RHEL 7.4 candidate build.

Comment 4 Geetika Kapoor 2017-05-30 13:37:39 UTC

Hi Fraser,

could you please provide some test use cases for this Bugzilla.

Thanks
Geetika

Comment 5 Fraser Tweedale 2017-05-31 08:59:25 UTC

This ticket is closely related to
https://bugzilla.redhat.com/show_bug.cgi?id=1303683.

This is not a feature we are actively using in IPA or elsewhere
at the moment, but we wanted to land the changes as early as possible.
IPA will make use of them in a future release.

Therefore, it is quite involved to test.  I recommend moving
on to other bugs, while I work on a blog post explaining
these features and provides examples that can be used to
verify the new functionality.

I'd also recommend the same QE contact verify both bugs.

Comment 6 Geetika Kapoor 2017-06-22 07:58:27 UTC

We didn't test this feature as mentioned in comment #5 .We just verify  that there are no issues on Subsystems side .

Comment 8 Fraser Tweedale 2017-07-24 01:09:13 UTC

Doc text is correct.

Comment 9 errata-xmlrpc 2017-08-01 22:48:25 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2110