Bug 1388622 - FreeIPA to Dogtag permission mapping plugin
Summary: FreeIPA to Dogtag permission mapping plugin
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: pki-core
Version: 7.3
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: 7.4
Assignee: Fraser Tweedale
QA Contact: Asha Akkiangady
Marc Muehlfeld
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-10-25 18:59 UTC by Matthew Harmsen
Modified: 2017-08-01 22:48 UTC (History)
3 users (show)

Fixed In Version: pki-core-10.4.1-1.el7, pki-core-10.4.1-1.el7.pki
Doc Type: Enhancement
Doc Text:
The "searchBase" configuration option has been added to the *DirAclAuthz* PKI Server plug-in To support reading different sets of authorization access control lists (ACL), the "searchBase" configuration option has been added to the *DirAclAuthz* PKI Server plug-in. As a result, you can set the sub-tree from which the plug-in loads ACLs.
Clone Of:
Environment:
Last Closed: 2017-08-01 22:48:25 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:2110 normal SHIPPED_LIVE pki-core bug fix and enhancement update 2017-08-01 19:36:59 UTC

Description Matthew Harmsen 2016-10-25 18:59:42 UTC
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/pki/ticket/2525

Support for GSS-API authentication (or other external authentication
where principal name and groups/permission are supplied in request
environment) entails the creation of an authorization plugin that can
knows how to map gropus/permissions defined by the external IdM system
(e.g. FreeIPA) to Dogtag operations.

Comment 1 Matthew Harmsen 2016-10-25 19:03:17 UTC
Per PKI Bug Council of 10/25/2016: 7.4 - critical

Verify as a part of the test plan (will be verified as a part of FreeIPA and potentially Dogtag).

Instructions will be documented per the following Wiki ticket:
* https://fedorahosted.org/pki/ticket/2528 - [WIKI] Document use of FreeIPA-to-Dogtag authorization plug-in

Comment 2 Fraser Tweedale 2017-04-07 01:38:27 UTC
This was committed to upstream:
76266bbf9b48f0ff01e7bfc9cd114c7ced460256

And is in the RHEL 7.4 candidate build.

Comment 4 Geetika Kapoor 2017-05-30 13:37:39 UTC
Hi Fraser,

could you please provide some test use cases for this Bugzilla.

Thanks
Geetika

Comment 5 Fraser Tweedale 2017-05-31 08:59:25 UTC
This ticket is closely related to
https://bugzilla.redhat.com/show_bug.cgi?id=1303683.

This is not a feature we are actively using in IPA or elsewhere
at the moment, but we wanted to land the changes as early as possible.
IPA will make use of them in a future release.

Therefore, it is quite involved to test.  I recommend moving
on to other bugs, while I work on a blog post explaining
these features and provides examples that can be used to
verify the new functionality.

I'd also recommend the same QE contact verify both bugs.

Comment 6 Geetika Kapoor 2017-06-22 07:58:27 UTC
We didn't test this feature as mentioned in comment #5 .We just verify  that there are no issues on Subsystems side .

Comment 8 Fraser Tweedale 2017-07-24 01:09:13 UTC
Doc text is correct.

Comment 9 errata-xmlrpc 2017-08-01 22:48:25 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2110


Note You need to log in before you can comment on or make changes to this bug.