freeipa

#5733 CA ACL rejects user when full principal name used
Closed: Fixed Opened by ftweedal.

Closed: Fixed
Reopen Issue

ipa cert-request fails when given full user principal name.

% ipa cert-request --principal alice@IPA.LOCAL alice.csr
ipa: ERROR: alice@ipa.local: user not found
% ipa cert-request --principal alice alice.csr
Principal: alice
  Certificate: MIIDrTC... (command succeeds)

The full principal name should be supported.

Thanks to ab for reporting this issue.

master:

  • c2b92b57354923a8099a0da446cef63802d2447b caacl: correctly handle full user principal name

ipa-4-3:

  • 90ca7d4167d25f50b36322a817f1f62930a7ea58 caacl: correctly handle full user principal name

ipa-4-2:

  • 8a8ee89cf738a3cdae848bd9db4d358d94da6d26 caacl: correctly handle full user principal name

Tests:

master:

  • b0b9972213760dcf351cdd85dbfe2c38fc21b2e6 ipatests: fix for change_principal context manager
  • 0472300dffc1b77533a6bb7397d6a5fa11439303 ipatests: Add test case for requesting a certificate with full principal.

ipa-4-3:

  • c4fa656b0e0850ddd6400caaa676eae4ec46da06 ipatests: fix for change_principal context manager
  • e183030067bae2df318324e9fcaafa8ea272f4b4 ipatests: Add test case for requesting a certificate with full principal.

ipa-4-2:

  • eadd47eec6ceb38b001bc9bff14e2a5aa83eb2ab ipatests: fix for change_principal context manager
  • ffd670379b16940499c1ef86d676c05886cb1116 ipatests: Add test case for requesting a certificate with full principal.

Metadata Update from @ftweedal:
- Issue assigned to ftweedal
- Issue set to the milestone: FreeIPA 4.2.5
Metadata
None
None
None
Normal
defect
Certificate management
1
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.