Bug 1108225 – ipadb.so could get tripped up by DAL changes to support keyless principals

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1108225 - ipadb.so could get tripped up by DAL changes to support keyless principals

Summary:	ipadb.so could get tripped up by DAL changes to support keyless principals

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	ipa (Show other bugs)
Sub Component:
Version:	7.1
Hardware:	Unspecified Unspecified

Priority	medium Severity unspecified
Target Milestone:	rc
Target Release:	---
Assigned To:	Martin Kosek
QA Contact:	Namita Soman
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2014-06-11 10:57 EDT by Martin Kosek
Modified:	2015-03-05 05:11 EST (History)
CC List:	5 users (show)

See Also:
Fixed In Version:	ipa-4.0.3-1.el7
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-03-05 05:11:53 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2015:0442	normal	SHIPPED_LIVE	Moderate: ipa security, bug fix, and enhancement update	2015-03-05 09:50:39 EST

Groups: None (edit)

Description Martin Kosek 2014-06-11 10:57:55 EDT

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/3779

Upcoming changes to upstream krb5 may result in modification requests that get passed into the IPA kdb plugin including a zero-length list of keys, which may or may not be NULL.

We need to make sure that the plugin isn't going to be tripped up by any of this, and that it correctly interprets this as a request from the caller to remove all of the keys from the principal entry (which in LDAP, I assume means removing the attribute value completely).

Comment 1 Martin Kosek 2014-06-11 11:23:27 EDT

This request is already fixed in upstream FreeIPA project. Please refer to the linked ticket for additional details and related commits.

Comment 2 Namita Soman 2014-06-26 01:10:45 EDT

Please add steps to verify

Comment 3 Martin Kosek 2014-06-26 04:24:30 EDT

This patch is about future proofing so that FreeIPA KDC backend is ready for keyless principals. AFAIU, there is no practical reproduction yet (CCing Nathaniel in case I am wrong). I would thus propose to simply test as SanityOnly.

Comment 5 Martin Kosek 2014-07-18 04:04:39 EDT

Please see Comment 3 for reproduction/how to test information.

Comment 13 errata-xmlrpc 2015-03-05 05:11:53 EST

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-0442.html

Note You need to log in before you can comment on or make changes to this bug.