Bug 677428

Summary: ipa cert-request: invalid principal name allowed
Product: [Retired] freeIPA Reporter: Yi Zhang <yzhang>
Component: ipa-serverAssignee: Rob Crittenden <rcritten>
Status: CLOSED ERRATA QA Contact: Chandrasekar Kannan <ckannan>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 2.0CC: benl, dpal, jgalipea
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: freeipa-2.1.0-1.fc15 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-03-28 09:27:23 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Yi Zhang 2011-02-14 18:54:34 UTC 
Description of problem:

This command success (and it should not)
-- note: principal name should not be "/FADN" format. it should be "serviceName/FQDN" format

[yi@works4me ipa-cert]$ ipa cert-request  ./autocert.1077.request.csr --request-type=pkcs10 --principal=/works4me.sjc.redhat.com --add
  Certificate: MIIDgjCCAmqgAwIBAgIBKzANBgkqhkiG9w0BAQsFADA5MRcwFQYDVQQKEw5TSkMuUkVESEFULkNPTTEeMBwGA1UEAxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTExMDIxNDE4NDU1OFoXDTExMDgxMzE4NDU1OFowOzEXMBUGA1UEChMOU0pDLlJFREhBVC5DT00xIDAeBgNVBAMTF3dvcmtzNG1lLnNqYy5yZWRoYXQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsEltxKKxTuCEP6JDCBb8Y163C58LVbANlqmsmhsaxTZkZKDncdtPGzFa4HHDuCC8zKJt2chRhMCx48n3yVxSq7L/D8bpR2Ypl+d5MeMrVTpHP1MjghpdcEOTXmYM72CS7uCfWEgx/APe2H+hw9mleBwrX0CO54Ti4azYqWP+5csq3ttx5rWYtQOB+7gDwmf9qjyBL91ziMH7dPk1XEfvonM4Njv9gyNAbMEX9h4WB/tGD+e/2jdTFWQnNgZtBV7wehS1TIN+Ocn0kaay2q5QakIrEISfyNkEeCgQUhduKbP7ZbY02SBOm9Qq76T64lHhxpe2nOiF3m+E88sSd327QwIDAQABo4GSMIGPMB8GA1UdIwQYMBaAFIfvs7dDyNGBz3XwFyLxS7BamhTgMEcGCCsGAQUFBwEBBDswOTA3BggrBgEFBQcwAYYraHR0cDovL3dvcmtzNG1lLnNqYy5yZWRoYXQuY29tOjkxODAvY2Evb2NzcDAOBgNVHQ8BAf8EBAMCBPAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggEBAJckvZX7HBHWQXhXYU2JmKpNOb3O4LhbslD3L2eLxf263zV3HNJUrgqV5K4BxigPB0MakWWuINUbQyxUz+HZ7/pDzaRfIAClNvKJ2jPqwXhdx4JUcsgskcLe4QIZXX+o81tictEzLbVIIO1V2YuluFi8gZVDw+iGoTKbvFZZT8+MoBDe0DHQ3COwwLA5JSwjTUZLXuRC8LIcUM+b1aUZRp8ywHqRkAqnknICuHMhqhYSheOfLUo1qvsvr5F7crUk3JKRAFYITriKXz41mM3RfzjR2h1y5hih6Tet8PAXUpW+27zQqPBGWUdxWP+82uiCPKi/lH7+/EomG1quZYrkzuE=
  Subject: CN=works4me.sjc.redhat.com,O=SJC.REDHAT.COM
  Issuer: CN=Certificate Authority,O=SJC.REDHAT.COM
  Not Before: Mon Feb 14 18:45:58 2011 UTC
  Not After: Sat Aug 13 18:45:58 2011 UTC
  Fingerprint (MD5): fc:b1:3c:85:10:0a:be:9b:9f:a1:41:17:c7:32:b8:f9
  Fingerprint (SHA1): 3a:f5:43:ac:e8:8e:ab:26:d0:85:aa:3a:06:a9:50:be:ca:e4:10:a3
  Serial number: 43

Version-Release number of selected component (if applicable):freeipa-server-2.0-0.2011020119gitec59e61.fc14.i686


How reproducible: always
Comment 1 Rob Crittenden 2011-02-14 19:00:12 UTC 
https://fedorahosted.org/freeipa/ticket/961
Comment 2 Rob Crittenden 2011-02-15 20:47:59 UTC 
empty services are no longer allowed.

master: f558ffe294ef451c0105127a67b6c8609f1ea2c2