Bug 727864 - Add support for new xmlrpc-c API to do GSSAPI delegation
Summary: Add support for new xmlrpc-c API to do GSSAPI delegation
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: certmonger
Version: 5.7
Hardware: Unspecified
OS: Unspecified
urgent
urgent
Target Milestone: rc
: ---
Assignee: Nalin Dahyabhai
QA Contact:
URL:
Whiteboard:
Depends On: 723645 727863
Blocks: 729803
TreeView+ depends on / blocked
 
Reported: 2011-08-03 13:03 UTC by Rob Crittenden
Modified: 2012-02-21 06:17 UTC (History)
4 users (show)

Fixed In Version: certmonger-0.50-1.el5
Doc Type: Bug Fix
Doc Text:
Clone Of: 727863
Environment:
Last Closed: 2012-02-21 06:17:19 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2012:0245 normal SHIPPED_LIVE certmonger bug fix and enhancement update 2012-02-20 15:07:20 UTC

Description Rob Crittenden 2011-08-03 13:03:10 UTC
+++ This bug was initially created as a clone of Bug #727863 +++

Description of problem:

libcurl upstream dropped support for delegating Kerberos tickets. This was
applied to EL6 in bug https://bugzilla.redhat.com/show_bug.cgi?id=711454

certmonger needs to be able to delegate tickets via XML-RPC to authenticate with IPA using xmlrpc-c.

Bug https://bugzilla.redhat.com/show_bug.cgi?id=719938 was created to add a new API to libcurl to do delegation.

Bug https://bugzilla.redhat.com/show_bug.cgi?id=719945 was created to add a new api to xmlrpc-c to utilize this delegation feature.

certmonger needs to be updated to use the new xmlrpc-c API.

Version-Release number of selected component (if applicable):

certmonger-0.42-1

Comment 3 Kaleem 2011-12-05 08:46:44 UTC
[root@ipa58client ~]# ipa-client-install --domain=pnq.redhat.com --realm=PNQ.REDHAT.COM -p admin -w Secret123 -U --server=ipa62server.pnq.redhat.com
Discovery was successful!
Hostname: ipa58client.pnq.redhat.com
Realm: PNQ.REDHAT.COM
DNS Domain: pnq.redhat.com
IPA Server: ipa62server.pnq.redhat.com
BaseDN: dc=pnq,dc=redhat,dc=com


Synchronizing time with KDC...

Enrolled in IPA realm PNQ.REDHAT.COM
Created /etc/ipa/default.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm PNQ.REDHAT.COM
SSSD enabled
NTP enabled
Client configuration complete.

[root@ipa58client ~]# kinit admin
Password for admin@PNQ.REDHAT.COM: 
[root@ipa58client ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin@PNQ.REDHAT.COM

Valid starting     Expires            Service principal
12/05/11 14:41:02  12/06/11 14:40:59  krbtgt/PNQ.REDHAT.COM@PNQ.REDHAT.COM


[root@ipa58client ~]# rpm -q curl xmlrpc-c certmonger ipa-client
curl-7.15.5-15.el5
curl-7.15.5-15.el5
xmlrpc-c-1.16.24-1206.1840.4.el5
certmonger-0.50-3.el5
ipa-client-2.1.3-1.el5
[root@ipa58client ~]#

Comment 4 errata-xmlrpc 2012-02-21 06:17:19 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0245.html


Note You need to log in before you can comment on or make changes to this bug.