Bug 1869609
| Summary: | Switch certmonger IPA responders to JSONRPC and remove xmlrpc-c dependency | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Martin Kosek <mkosek> |
| Component: | certmonger | Assignee: | Rob Crittenden <rcritten> |
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.2 | CC: | ksiddiqu, myusuf, nalin, ndehadra, pvoborni, rcritten, ssidhaye |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | 8.0 | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | certmonger-0.79.13-1.el8 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-05-18 15:49:54 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Martin Kosek
2020-08-18 11:01:35 UTC
Related upstream BZ https://bugzilla.redhat.com/show_bug.cgi?id=1869370 Upstream PRs: https://pagure.io/certmonger/pull-request/167 https://pagure.io/certmonger/pull-request/172 To validate you don't need to tweak the debug level. It logs the json result at log level 1 and IPA sets it to 2 by default.
The reproduction steps are:
# ipa service-add test/`hostname`
# ipa-getcert request -f /etc/pki/tls/certs/test.pem -k /etc/pki/tls/private/test.key -K test/`hostname` -w
# journalctl -u certmonger
Look for something like this. The resulting json returned by IPA is displayed:
Nov 03 09:47:02 ipa.example.test certmonger[3080129]: 2020-11-03 09:47:02 [3080129] Running enrollment helper "/usr/libexec/certmonger/ipa-server-guard".
Nov 03 09:47:02 ipa.example.test certmonger[3079897]: 2020-11-03 09:47:02 [3079897] Request11('20201103144702') moved to state 'SUBMITTING'
Nov 03 09:47:02 ipa.example.test certmonger[3079897]: 2020-11-03 09:47:02 [3079897] Will revisit Request11('20201103144702') on traffic from 15.
Nov 03 09:47:03 ipa.example.test ipa-submit[3080130]: {
"error": null,
"id": null,
"principal": "host/ipa.example.test",
"result": {
"messages": [
{
"code": 13001,
"data": {
"server_version": "2.240"
},
"message": "API Version number was not sent, forward compatibility not guaranteed. Assuming server's API version, 2.240",
"name": "VersionMissing",
"type": "warning"
}
],
"result": {
"cacn": "ipa",
"certificate": "MII...k=",
"issuer": "CN=Certificate Authority,O=EXAMPLE.TEST",
"request_id": 13,
"san_dnsname": [
"ipa.example.test"
],
"san_other_kpn": [
"test/ipa.example.test"
],
"san_other_upn": [
"test/ipa.example.test"
],
"serial_number": 13,
"serial_number_hex": "0xD",
"subject": "CN=ipa.example.test,O=EXAMPLE.TEST",
"valid_not_after": "Fri Nov 04 13:47:02 2022 UTC",
"valid_not_before": "Tue Nov 03 14:47:02 2020 UTC"
},
"summary": null,
"value": 13
},
"version": "4.9.0.dev202010270039+git295ef4968"
}
Build used for verification:
ipa-client-4.9.0-0.5.rc3.module+el8.4.0+9124+ced20601.x86_64
ipa-client-common-4.9.0-0.5.rc3.module+el8.4.0+9124+ced20601.noarch
ipa-common-4.9.0-0.5.rc3.module+el8.4.0+9124+ced20601.noarch
ipa-healthcheck-core-0.7-3.module+el8.4.0+9007+5084bdd8.noarch
ipa-selinux-4.9.0-0.5.rc3.module+el8.4.0+9124+ced20601.noarch
ipa-server-4.9.0-0.5.rc3.module+el8.4.0+9124+ced20601.x86_64
ipa-server-common-4.9.0-0.5.rc3.module+el8.4.0+9124+ced20601.noarch
ipa-server-dns-4.9.0-0.5.rc3.module+el8.4.0+9124+ced20601.noarch
ipa-server-trust-ad-4.9.0-0.5.rc3.module+el8.4.0+9124+ced20601.x86_64
============================= test session starts ==============================
platform linux -- Python 3.6.8, pytest-3.10.1, py-1.10.0, pluggy-0.13.1 -- /usr/libexec/platform-python
cachedir: /home/cloud-user/.pytest_cache
metadata: {'Python': '3.6.8', 'Platform': 'Linux-4.18.0-264.el8.x86_64-x86_64-with-redhat-8.4-Ootpa', 'Packages': {'pytest': '3.10.1', 'py': '1.10.0', 'pluggy': '0.13.1'}, 'Plugins': {'metadata': '1.11.0', 'html': '1.22.1', 'multihost': '3.0', 'sourceorder': '0.5'}}
rootdir: /usr/lib/python3.6/site-packages/ipatests, inifile:
plugins: metadata-1.11.0, html-1.22.1, multihost-3.0, sourceorder-0.5
collecting ... collected 10 items
test_integration/test_cert.py::TestInstallMasterClient::test_cacert_file_appear_with_option_F PASSED [ 10%]
test_integration/test_cert.py::TestInstallMasterClient::test_certmonger_ipa_responder_jsonrpc PASSED [ 20%]
test_integration/test_cert.py::TestInstallMasterClient::test_ipa_getcert_san_aci PASSED [ 30%]
test_integration/test_cert.py::TestInstallMasterClient::test_getcert_list_profile PASSED [ 40%]
test_integration/test_cert.py::TestInstallMasterClient::test_getcert_list_profile_using_subca PASSED [ 50%]
test_integration/test_cert.py::TestCertmongerRekey::test_certmonger_rekey_keysize PASSED [ 60%]
test_integration/test_cert.py::TestCertmongerRekey::test_rekey_keytype_RSA PASSED [ 70%]
test_integration/test_cert.py::TestCertmongerRekey::test_rekey_request_id PASSED [ 80%]
test_integration/test_cert.py::TestCertmongerRekey::test_rekey_keytype_DSA PASSED [ 90%]
test_integration/test_cert.py::TestCertmongerInterruption::test_certmomger_tracks_renewed_certs_during_interruptions PASSED [100%]
---------------- generated xml file: /home/cloud-user/junit.xml ----------------
----------- generated html file: file:///home/cloud-user/report.html -----------
========================= 10 passed in 1604.41 seconds =========================
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (certmonger bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:1851 |