summaryrefslogtreecommitdiffstats
path: root/ipaserver
diff options
context:
space:
mode:
authorRob Crittenden <rcritten@redhat.com>2009-11-03 09:35:19 -0500
committerJason Gerard DeRose <jderose@redhat.com>2009-11-03 09:04:05 -0700
commitbd619adb5c1cfcd9e72c18896aded82e2ab33faa (patch)
tree749d6ef90707772a5146d03c6bc78ef59a5f664c /ipaserver
parente4c119ed4b05fe600377360e697483bd59000b37 (diff)
downloadfreeipa-bd619adb5c1cfcd9e72c18896aded82e2ab33faa.tar.gz
freeipa-bd619adb5c1cfcd9e72c18896aded82e2ab33faa.tar.xz
freeipa-bd619adb5c1cfcd9e72c18896aded82e2ab33faa.zip
Use a new mechanism for delegating certificate issuance.
Using the client IP address was a rather poor mechanism for controlling who could request certificates for whom. Instead the client machine will bind using the host service principal and request the certificate. In order to do this: * the service will need to exist * the machine needs to be in the certadmin rolegroup * the host needs to be in the managedBy attribute of the service It might look something like: admin ipa host-add client.example.com --password=secret123 ipa service-add HTTP/client.example.com ipa service-add-host --hosts=client.example.com HTTP/client.example.com ipa rolegroup-add-member --hosts=client.example.com certadmin client ipa-client-install ipa-join -w secret123 kinit -kt /etc/krb5.keytab host/client.example.com ipa -d cert-request file://web.csr --principal=HTTP/client.example.com
Diffstat (limited to 'ipaserver')
-rw-r--r--ipaserver/plugins/ldap2.py2
1 files changed, 1 insertions, 1 deletions
diff --git a/ipaserver/plugins/ldap2.py b/ipaserver/plugins/ldap2.py
index f8e06576d..38fdb6210 100644
--- a/ipaserver/plugins/ldap2.py
+++ b/ipaserver/plugins/ldap2.py
@@ -512,7 +512,7 @@ class ldap2(CrudBackend, Encoder):
attributes and the entryLevelRights for the entry itself.
"""
principal = getattr(context, 'principal')
- (binddn, attrs) = self.find_entry_by_attr("krbprincipalname", principal, "posixAccount")
+ (binddn, attrs) = self.find_entry_by_attr("krbprincipalname", principal, "krbPrincipalAux")
sctrl = [LDAPControl("1.3.6.1.4.1.42.2.27.9.5.2", True, "dn: " + binddn.encode('UTF-8'))]
self.conn.set_option(_ldap.OPT_SERVER_CONTROLS, sctrl)
(dn, attrs) = self.get_entry(dn, entry_attrs)