diff options
| author | Fraser Tweedale <ftweedal@redhat.com> | 2015-08-04 01:13:09 -0400 |
|---|---|---|
| committer | Martin Basti <mbasti@redhat.com> | 2015-08-14 14:02:05 +0200 |
| commit | 6fa14fd21e664925268d80a2263c556b2bc35139 (patch) | |
| tree | 7bf4d8ad5dfaa8b94f3086752b5ba475e0d4383c | |
| parent | 6b978d74ae36f377c2d4f2cae860ca79b102e3c0 (diff) | |
| download | freeipa-6fa14fd21e664925268d80a2263c556b2bc35139.tar.gz freeipa-6fa14fd21e664925268d80a2263c556b2bc35139.tar.xz freeipa-6fa14fd21e664925268d80a2263c556b2bc35139.zip | |
Add permission for bypassing CA ACL enforcement
Add the "Request Certificate ignoring CA ACLs" permission and
associated ACI, initially assigned to "Certificate Administrators"
privilege.
Update cert-request command to skip CA ACL enforcement when the bind
principal has this permission.
Fixes: https://fedorahosted.org/freeipa/ticket/5099
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
| -rw-r--r-- | install/updates/40-delegation.update | 15 | ||||
| -rw-r--r-- | ipalib/plugins/cert.py | 13 |
2 files changed, 25 insertions, 3 deletions
diff --git a/install/updates/40-delegation.update b/install/updates/40-delegation.update index bc0736c5b..8d4f6296c 100644 --- a/install/updates/40-delegation.update +++ b/install/updates/40-delegation.update @@ -144,6 +144,21 @@ default:member: cn=Certificate Administrators,cn=privileges,cn=pbac,$SUFFIX dn: $SUFFIX add:aci:(targetattr = "objectclass")(target = "ldap:///cn=request certificate with subjectaltname,cn=virtual operations,cn=etc,$SUFFIX" )(version 3.0; acl "permission:Request Certificate with SubjectAltName"; allow (write) groupdn = "ldap:///cn=Request Certificate with SubjectAltName,cn=permissions,cn=pbac,$SUFFIX";) +dn: cn=request certificate ignore caacl,cn=virtual operations,cn=etc,$SUFFIX +default:objectClass: top +default:objectClass: nsContainer +default:cn: request certificate ignore caacl + +dn: cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,$SUFFIX +default:objectClass: top +default:objectClass: groupofnames +default:objectClass: ipapermission +default:cn: Request Certificate ignoring CA ACLs +default:member: cn=Certificate Administrators,cn=privileges,cn=pbac,$SUFFIX + +dn: $SUFFIX +add:aci:(targetattr = "objectclass")(target = "ldap:///cn=request certificate ignore caacl,cn=virtual operations,cn=etc,$SUFFIX" )(version 3.0; acl "permission:Request Certificate ignoring CA ACLs"; allow (write) groupdn = "ldap:///cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,$SUFFIX";) + # Read privileges dn: cn=RBAC Readers,cn=privileges,cn=pbac,$SUFFIX diff --git a/ipalib/plugins/cert.py b/ipalib/plugins/cert.py index c0b459d38..399d90b11 100644 --- a/ipalib/plugins/cert.py +++ b/ipalib/plugins/cert.py @@ -345,8 +345,6 @@ class cert_request(VirtualCommand): else: principal_type = SERVICE - caacl_check(principal_type, principal_string, ca, profile_id) - bind_principal = split_any_principal(getattr(context, 'principal')) bind_service, bind_name, bind_realm = bind_principal @@ -362,6 +360,15 @@ class cert_request(VirtualCommand): self.check_access() try: + self.check_access("request certificate ignore caacl") + bypass_caacl = True + except errors.ACIError: + bypass_caacl = False + + if not bypass_caacl: + caacl_check(principal_type, principal_string, ca, profile_id) + + try: subject = pkcs10.get_subject(csr) extensions = pkcs10.get_extensions(csr) subjectaltname = pkcs10.get_subjectaltname(csr) or () @@ -469,7 +476,7 @@ class cert_request(VirtualCommand): raise errors.ACIError(info=_( "Insufficient privilege to create a certificate " "with subject alt name '%s'.") % name) - if alt_principal_string is not None: + if alt_principal_string is not None and not bypass_caacl: caacl_check( principal_type, alt_principal_string, ca, profile_id) elif name_type in (pkcs10.SAN_OTHERNAME_KRB5PRINCIPALNAME, |