SSSD / sssd

#3192 [sssd-secrets] https proxy talks plain http
Closed: Fixed Opened by cheimes.

Closed: Fixed
Reopen Issue

sssd-secrets claims to support http and https proxies. However https does not actually talk TLS/SSL. According to Wireshark it sends plain HTTP.

[sssd]
services = nss
domains = local
config_file_version = 2
[domain/local]
id_provider=local
[secrets]
debug_level = 1310
timeout = 3000
[secrets/users/0]
provider=proxy
proxy_url = https://localhost:10443/secrets/

In my opinion sssd-secrets should not offer plain http at all. Instead it should only support https for remote servers and http+unix for local servers. Since HTTPS is rather complicated libcurl might be a good option. libcurl can perform HTTP over Unix, custom CA certs and TLS client cert authentication -- all features I'd like to see in sssd-secrets.

Christian, do you see this as more of a nice to have or required for some of the integration work you are doing? Just trying to figure out the best milestone here..

I see HTTPS support as a requirement for production use. HTTP is only good enough for a product demo or proof-of-concept. IMHO sssd-secrets should not support plain HTTP in the first place.

HTTPS support with optional client cert authentication would make my integration work a bit easier. Custodia pulls in Python and several additional dependencies. The sssd secrets service provides a lightweight proxy.

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.15 Beta

Fields changed

rhbz: => todo

Fields changed

priority: major => critical

Linked to Bugzilla bug: https://bugzilla.redhat.com/show_bug.cgi?id=1398701

rhbz: todo => [https://bugzilla.redhat.com/show_bug.cgi?id=1398701 1398701]

Fields changed

owner: somebody => pbrezina
status: new => assigned

Fields changed

milestone: SSSD 1.16 Beta => SSSD 1.15.1

Fields changed

priority: critical => major

Metadata Update from @cheimes:
- Issue assigned to pbrezina
- Issue set to the milestone: SSSD 1.15.1

Since we are releasing 1.15.1 today, I'm moving all unfinished tickets from 1.15.1 to 1.15.2

Metadata Update from @jhrozek:
- Custom field design_review reset
- Custom field mark reset
- Custom field patch reset
- Custom field review reset
- Custom field sensitive reset
- Custom field testsupdated reset
- Issue close_status updated to: None

Since we are releasing 1.15.1 today, I'm moving all unfinished tickets from 1.15.1 to 1.15.2

Metadata Update from @jhrozek:
- Custom field design_review reset
- Custom field mark reset
- Custom field patch reset
- Custom field review reset
- Custom field sensitive reset
- Custom field testsupdated reset

Metadata Update from @jhrozek:
- Custom field design_review reset
- Custom field mark reset
- Custom field patch reset
- Custom field review reset
- Custom field sensitive reset
- Custom field testsupdated reset
- Issue set to the milestone: SSSD 1.15.2 (was: SSSD 1.15.1)

Metadata Update from @jhrozek:
- Custom field design_review reset
- Custom field mark reset
- Custom field patch reset
- Custom field review reset
- Custom field sensitive reset
- Custom field testsupdated reset
- Issue set to the milestone: SSSD 1.15.3 (was: SSSD 1.15.2)

master:

  • 13d720de13e490850c1139eea865bcd5195a2630
  • db826f57b4c2ee814823057cc536386889f7aa1d
  • af026ea6a6e812b7d6c5c889dda64ba7b7c433ee
  • 720e1a5b95a953a0f1c8315bbb7c9c1edf9fb417
  • 06744bf5a47d5971a338281c8243b11cf72dac90
  • df99d709c8cbef3c378c111944d83b7345e4c1ea
  • 793f2573b2beaf8b48eab850429482acf68ec2b1
  • 6698d40512e55e7c2d03e14c227c51b1edc77ffa
  • ae6b11229d9961e26922918183c7c1de7780b8d6
  • d1ed11fc50922aab2332758a9300f3fbf814f112
  • c2ea75da72b426d98ba489039e220d417bfb4c2a
  • 886e0f75e6f4c7877a23a3625f8a20c09109b09d
  • 36e49a842e257ac9bde71728ee3bef4299b6e6e2
  • b800a6d09244359959404aca81c6796a58cafbcb
  • 300b9e9217ee1ed8d845ed2370c5ccf5c87afb36

Metadata Update from @lslebodn:
- Custom field design_review reset (from false)
- Custom field mark reset (from false)
- Custom field patch reset (from false)
- Custom field review reset (from false)
- Custom field sensitive reset (from false)
- Custom field testsupdated reset (from false)

Metadata Update from @lslebodn:
- Custom field design_review reset (from false)
- Custom field mark reset (from false)
- Custom field patch reset (from false)
- Custom field review reset (from false)
- Custom field sensitive reset (from false)
- Custom field testsupdated reset (from false)
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4225

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
Normal
defect
SSSD
1.14.1
None
None
false
false
false
https://bugzilla.redhat.com/show_bug.cgi?id=1398701
false
false
false
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.