Bug 1388622 – FreeIPA to Dogtag permission mapping plugin

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1388622 - FreeIPA to Dogtag permission mapping plugin

Summary:	FreeIPA to Dogtag permission mapping plugin

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	pki-core (Show other bugs)
Sub Component:
Version:	7.3
Hardware:	Unspecified Unspecified

Priority	medium Severity unspecified
Target Milestone:	rc
Target Release:	7.4
Assigned To:	Fraser Tweedale
QA Contact:	Asha Akkiangady
Docs Contact:	Marc Muehlfeld

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2016-10-25 14:59 EDT by Matthew Harmsen
Modified:	2017-08-01 18:48 EDT (History)
CC List:	3 users (show)

See Also:
Fixed In Version:	pki-core-10.4.1-1.el7, pki-core-10.4.1-1.el7.pki
Doc Type:	Enhancement
Doc Text:	The "searchBase" configuration option has been added to the DirAclAuthz PKI Server plug-in To support reading different sets of authorization access control lists (ACL), the "searchBase" configuration option has been added to the DirAclAuthz PKI Server plug-in. As a result, you can set the sub-tree from which the plug-in loads ACLs.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-08-01 18:48:25 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2017:2110	normal	SHIPPED_LIVE	pki-core bug fix and enhancement update	2017-08-01 15:36:59 EDT

Groups: None (edit)

Description Matthew Harmsen 2016-10-25 14:59:42 EDT

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/pki/ticket/2525

Support for GSS-API authentication (or other external authentication
where principal name and groups/permission are supplied in request
environment) entails the creation of an authorization plugin that can
knows how to map gropus/permissions defined by the external IdM system
(e.g. FreeIPA) to Dogtag operations.

Comment 1 Matthew Harmsen 2016-10-25 15:03:17 EDT

Per PKI Bug Council of 10/25/2016: 7.4 - critical

Verify as a part of the test plan (will be verified as a part of FreeIPA and potentially Dogtag).

Instructions will be documented per the following Wiki ticket:
* https://fedorahosted.org/pki/ticket/2528 - [WIKI] Document use of FreeIPA-to-Dogtag authorization plug-in

Comment 2 Fraser Tweedale 2017-04-06 21:38:27 EDT

This was committed to upstream:
76266bbf9b48f0ff01e7bfc9cd114c7ced460256

And is in the RHEL 7.4 candidate build.

Comment 4 Geetika Kapoor 2017-05-30 09:37:39 EDT

Hi Fraser,

could you please provide some test use cases for this Bugzilla.

Thanks
Geetika

Comment 5 Fraser Tweedale 2017-05-31 04:59:25 EDT

This ticket is closely related to
https://bugzilla.redhat.com/show_bug.cgi?id=1303683.

This is not a feature we are actively using in IPA or elsewhere
at the moment, but we wanted to land the changes as early as possible.
IPA will make use of them in a future release.

Therefore, it is quite involved to test.  I recommend moving
on to other bugs, while I work on a blog post explaining
these features and provides examples that can be used to
verify the new functionality.

I'd also recommend the same QE contact verify both bugs.

Comment 6 Geetika Kapoor 2017-06-22 03:58:27 EDT

We didn't test this feature as mentioned in comment #5 .We just verify  that there are no issues on Subsystems side .

Comment 8 Fraser Tweedale 2017-07-23 21:09:13 EDT

Doc text is correct.

Comment 9 errata-xmlrpc 2017-08-01 18:48:25 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2110

Note You need to log in before you can comment on or make changes to this bug.