Bug 727864

Summary: Add support for new xmlrpc-c API to do GSSAPI delegation
Product: Red Hat Enterprise Linux 5 Reporter: Rob Crittenden <rcritten>
Component: certmongerAssignee: Nalin Dahyabhai <nalin>
Status: CLOSED ERRATA QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: 5.7CC: dpal, jgalipea, kchamart, ksiddiqu
Target Milestone: rcKeywords: ZStream
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: certmonger-0.50-1.el5 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 727863 Environment:
Last Closed: 2012-02-21 06:17:19 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 723645, 727863    
Bug Blocks: 729803    

Description Rob Crittenden 2011-08-03 13:03:10 UTC
+++ This bug was initially created as a clone of Bug #727863 +++

Description of problem:

libcurl upstream dropped support for delegating Kerberos tickets. This was
applied to EL6 in bug https://bugzilla.redhat.com/show_bug.cgi?id=711454

certmonger needs to be able to delegate tickets via XML-RPC to authenticate with IPA using xmlrpc-c.

Bug https://bugzilla.redhat.com/show_bug.cgi?id=719938 was created to add a new API to libcurl to do delegation.

Bug https://bugzilla.redhat.com/show_bug.cgi?id=719945 was created to add a new api to xmlrpc-c to utilize this delegation feature.

certmonger needs to be updated to use the new xmlrpc-c API.

Version-Release number of selected component (if applicable):

certmonger-0.42-1

Comment 3 Kaleem 2011-12-05 08:46:44 UTC
[root@ipa58client ~]# ipa-client-install --domain=pnq.redhat.com --realm=PNQ.REDHAT.COM -p admin -w Secret123 -U --server=ipa62server.pnq.redhat.com
Discovery was successful!
Hostname: ipa58client.pnq.redhat.com
Realm: PNQ.REDHAT.COM
DNS Domain: pnq.redhat.com
IPA Server: ipa62server.pnq.redhat.com
BaseDN: dc=pnq,dc=redhat,dc=com


Synchronizing time with KDC...

Enrolled in IPA realm PNQ.REDHAT.COM
Created /etc/ipa/default.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm PNQ.REDHAT.COM
SSSD enabled
NTP enabled
Client configuration complete.

[root@ipa58client ~]# kinit admin
Password for admin.COM: 
[root@ipa58client ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin.COM

Valid starting     Expires            Service principal
12/05/11 14:41:02  12/06/11 14:40:59  krbtgt/PNQ.REDHAT.COM.COM


[root@ipa58client ~]# rpm -q curl xmlrpc-c certmonger ipa-client
curl-7.15.5-15.el5
curl-7.15.5-15.el5
xmlrpc-c-1.16.24-1206.1840.4.el5
certmonger-0.50-3.el5
ipa-client-2.1.3-1.el5
[root@ipa58client ~]#

Comment 4 errata-xmlrpc 2012-02-21 06:17:19 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0245.html