diff options
| author | Rob Crittenden <rcritten@redhat.com> | 2009-10-20 11:59:07 -0400 |
|---|---|---|
| committer | Jason Gerard DeRose <jderose@redhat.com> | 2009-10-21 03:22:44 -0600 |
| commit | 453a19fcaca9c2be1e3d0e78b734bd05e7d50764 (patch) | |
| tree | 76d5a8516f1d515e74da848050eae32732a64fad /ipaserver/rpcserver.py | |
| parent | aa2183578cb58d9f55b5f1b64c13627b88dae37c (diff) | |
| download | freeipa-453a19fcaca9c2be1e3d0e78b734bd05e7d50764.tar.gz freeipa-453a19fcaca9c2be1e3d0e78b734bd05e7d50764.tar.xz freeipa-453a19fcaca9c2be1e3d0e78b734bd05e7d50764.zip | |
First pass at enforcing certificates be requested from same host
We want to only allow a machine to request a certificate for itself, not for
other machines. I've added a new taksgroup which will allow this.
The requesting IP is resolved and compared to the subject of the CSR to
determine if they are the same host. The same is done with the service
principal. Subject alt names are not queried yet.
This does not yet grant machines actual permission to request certificates
yet, that is still limited to the taskgroup request_certs.
Diffstat (limited to 'ipaserver/rpcserver.py')
| -rw-r--r-- | ipaserver/rpcserver.py | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ipaserver/rpcserver.py b/ipaserver/rpcserver.py index c98ca7ab7..ab8b41720 100644 --- a/ipaserver/rpcserver.py +++ b/ipaserver/rpcserver.py @@ -181,12 +181,12 @@ class xmlserver(WSGIExecutioner): def methodHelp(self, *params): return u'methodHelp not implemented' - def marshaled_dispatch(self, data, ccache): + def marshaled_dispatch(self, data, ccache, client_ip): """ Execute the XML-RPC request contained in ``data``. """ try: - self.create_context(ccache=ccache) + self.create_context(ccache=ccache, client_ip=client_ip) (params, name) = xml_loads(data) if name in self.__system: response = (self.__system[name](*params),) |