Bug 1878797 - Clearly state requirements for CAs as arguments to ipa-advise generated scripts for Smartcards
Summary: Clearly state requirements for CAs as arguments to ipa-advise generated scrip...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: Documentation
Version: 8.2
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: 8.0
Assignee: lmcgarry
QA Contact: RHEL DPM
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-09-14 14:25 UTC by Rich Lucente
Modified: 2020-12-05 12:20 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-12-05 12:20:03 UTC
Type: Bug
Target Upstream Version:


Attachments (Terms of Use)

Description Rich Lucente 2020-09-14 14:25:55 UTC
Document URL:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_and_managing_identity_management/configuring-idm-for-smart-card-auth_configuring-and-managing-idm

Section Number and Name:
39.1. Configuring the IdM server for smart card authentication
39.2. Configuring the IdM client for smart card authentication

Describe the issue:
 
Smartcard scripts generated by ipa-advise must have CAs provided in their argument list. The scripts will fail to complete if either of the following occurs:
1) sub root CAs appear in the argument list before their root CAs
2) any CA is expired, aborting the script and not processing any other CAs on the command line

Suggestions for improvement:
The documentation should clearly state that the root CAs must be provided on the command line before any sub root CAs and that no CA can be expired (or expire within the time necessary to run the script)

Additional information: 
I created a script at https://gitlab.cee.redhat.com/rlucente/idm-dod-cac-auth that downloads US Department of Defense CAs, breaks out CAs into individual PEM files, performs sanity checks, then presents the CAs to the ipa-advise generated scripts in the proper order.


Note You need to log in before you can comment on or make changes to this bug.