freeipa

#6876 GET in KerberosSession.finalize_kerberos_acquisition() must use FreeIPA CA
Closed: fixed Opened by cheimes.

Closed: fixed
Reopen Issue

KerberosSession.finalize_kerberos_acquisition() uses requests to interact with IPA. The request.get() call performs a HTTP GET over HTTPS but fails to use FreeIPA's private CA file.

From discussion with @cheimes , this part of code doesn't use the same cert store as other places. There it may potentially cause issues e.g. in setup with External CA (CLI or Web UI login).

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1445397

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1445397

Issue linked to bug 1445397

see how it was fixed in #6686 16dac0252e52c8de07fd8a6a86ec0896074cbe9d

Metadata Update from @pvoborni:
- Issue assigned to pvoborni

Metadata Update from @pvoborni:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/734

Metadata Update from @pvoborni:
- Issue priority set to: critical
- Issue set to the milestone: FreeIPA 4.5.1

master:

  • c19196a0d3fc0a38c4c83cb8a7fde56e6bc310af kerberos session: use CA cert with full cert chain for obtaining cookie

ipa-4-5:

  • 82679c11f1fc0701d753433d1f2d14c3ee0279af kerberos session: use CA cert with full cert chain for obtaining cookie

Metadata Update from @mbasti:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Low
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.