Bug 1388622 - FreeIPA to Dogtag permission mapping plugin
Summary: FreeIPA to Dogtag permission mapping plugin
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: pki-core
Version: 7.3
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: 7.4
Assignee: Fraser Tweedale
QA Contact: Asha Akkiangady
Marc Muehlfeld
Depends On:
TreeView+ depends on / blocked
Reported: 2016-10-25 18:59 UTC by Matthew Harmsen
Modified: 2020-10-04 21:18 UTC (History)
3 users (show)

Fixed In Version: pki-core-10.4.1-1.el7, pki-core-10.4.1-1.el7.pki
Doc Type: Enhancement
Doc Text:
The "searchBase" configuration option has been added to the *DirAclAuthz* PKI Server plug-in To support reading different sets of authorization access control lists (ACL), the "searchBase" configuration option has been added to the *DirAclAuthz* PKI Server plug-in. As a result, you can set the sub-tree from which the plug-in loads ACLs.
Clone Of:
Last Closed: 2017-08-01 22:48:25 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github dogtagpki pki issues 2645 0 None None None 2020-10-04 21:18:29 UTC
Red Hat Product Errata RHBA-2017:2110 0 normal SHIPPED_LIVE pki-core bug fix and enhancement update 2017-08-01 19:36:59 UTC

Description Matthew Harmsen 2016-10-25 18:59:42 UTC
This bug is created as a clone of upstream ticket:

Support for GSS-API authentication (or other external authentication
where principal name and groups/permission are supplied in request
environment) entails the creation of an authorization plugin that can
knows how to map gropus/permissions defined by the external IdM system
(e.g. FreeIPA) to Dogtag operations.

Comment 1 Matthew Harmsen 2016-10-25 19:03:17 UTC
Per PKI Bug Council of 10/25/2016: 7.4 - critical

Verify as a part of the test plan (will be verified as a part of FreeIPA and potentially Dogtag).

Instructions will be documented per the following Wiki ticket:
* https://fedorahosted.org/pki/ticket/2528 - [WIKI] Document use of FreeIPA-to-Dogtag authorization plug-in

Comment 2 Fraser Tweedale 2017-04-07 01:38:27 UTC
This was committed to upstream:

And is in the RHEL 7.4 candidate build.

Comment 4 Geetika Kapoor 2017-05-30 13:37:39 UTC
Hi Fraser,

could you please provide some test use cases for this Bugzilla.


Comment 5 Fraser Tweedale 2017-05-31 08:59:25 UTC
This ticket is closely related to

This is not a feature we are actively using in IPA or elsewhere
at the moment, but we wanted to land the changes as early as possible.
IPA will make use of them in a future release.

Therefore, it is quite involved to test.  I recommend moving
on to other bugs, while I work on a blog post explaining
these features and provides examples that can be used to
verify the new functionality.

I'd also recommend the same QE contact verify both bugs.

Comment 6 Geetika Kapoor 2017-06-22 07:58:27 UTC
We didn't test this feature as mentioned in comment #5 .We just verify  that there are no issues on Subsystems side .

Comment 8 Fraser Tweedale 2017-07-24 01:09:13 UTC
Doc text is correct.

Comment 9 errata-xmlrpc 2017-08-01 22:48:25 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.