diff options
| author | Rob Crittenden <rcritten@redhat.com> | 2009-10-20 11:59:07 -0400 |
|---|---|---|
| committer | Jason Gerard DeRose <jderose@redhat.com> | 2009-10-21 03:22:44 -0600 |
| commit | 453a19fcaca9c2be1e3d0e78b734bd05e7d50764 (patch) | |
| tree | 76d5a8516f1d515e74da848050eae32732a64fad /ipalib/backend.py | |
| parent | aa2183578cb58d9f55b5f1b64c13627b88dae37c (diff) | |
| download | freeipa-453a19fcaca9c2be1e3d0e78b734bd05e7d50764.tar.gz freeipa-453a19fcaca9c2be1e3d0e78b734bd05e7d50764.tar.xz freeipa-453a19fcaca9c2be1e3d0e78b734bd05e7d50764.zip | |
First pass at enforcing certificates be requested from same host
We want to only allow a machine to request a certificate for itself, not for
other machines. I've added a new taksgroup which will allow this.
The requesting IP is resolved and compared to the subject of the CSR to
determine if they are the same host. The same is done with the service
principal. Subject alt names are not queried yet.
This does not yet grant machines actual permission to request certificates
yet, that is still limited to the taskgroup request_certs.
Diffstat (limited to 'ipalib/backend.py')
| -rw-r--r-- | ipalib/backend.py | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/ipalib/backend.py b/ipalib/backend.py index b123ed140..7c964b799 100644 --- a/ipalib/backend.py +++ b/ipalib/backend.py @@ -97,10 +97,15 @@ class Executioner(Backend): def create_context(self, ccache=None, client_ip=None): + """ + client_ip: The IP address of the remote client. + """ if self.env.in_server: self.Backend.ldap2.connect(ccache=ccache) else: self.Backend.xmlclient.connect() + if client_ip is not None: + setattr(context, "client_ip", client_ip) def destroy_context(self): destroy_context() |