freeipa

#6937 Provide an API command to retrieve PKINIT status in the FreeIPA topology
Closed: fixed Opened by mbabinsk.

Closed: fixed
Reopen Issue

In mixed FreeIPA topologies (pre 4.5 and 4.5 masters) it may be useful to have a tool reporting masters which have PKINIT enabled. This could greatly simplify troubleshooting in cases when some of the clients attempt to request TGT via PKINIT and fail (maybe due to resolving a old KDC that does not understand PKINIT yet).

Since PKINIT is an attribute of KDC shared by multiple masters, we may reuse the Server-Roles API (after slight modifications) to report PKINIT status based on pkinitEnabled value set on KDC entry's ipaConfigString. This can be reported in ipaconfig and we can also provide a dedicated ipa pkinit-status command to retrieve this info.

Metadata Update from @pvoborni:
- Issue priority set to: blocker
- Issue set to the milestone: FreeIPA 4.5.1

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1449523

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1449523

Issue linked to bug 1449523

Metadata Update from @pvoborni:
- Issue assigned to mbabinsk

Metadata Update from @mbasti:
- Issue set to the milestone: FreeIPA 4.5.2 (was: FreeIPA 4.5.1)

FreeIPA 4.5.2

ipa-4-5:

  • c4aa3a17694b1ad8f9c60c98a95d217c01fc736c Allow for multivalued server attributes
  • 753f8cf3aff07d22b35005b973e8518665d1fe6f Refactor the role/attribute member reporting code
  • fbccb748a1c85b7ed67946ba7a11a960b839bcc9 Add an attribute reporting client PKINIT-capable servers
  • 733cef9d5b0ae83127893ffff71689939902d257 Add the list of PKINIT servers as a virtual attribute to global config
  • 6b815aae7174693b4952f2c60e7201d99e7b9684 Add pkinit-status command
  • 4fa29a33765cb5d6ce86846f37766e5d3322f25f test_serverroles: Get rid of MockLDAP and use ldap2 instead

master:

  • bddb90f38a3505a2768862d2f814c5e749a7dcde Allow for multivalued server attributes
  • cac7e49daa04e838650548cc9162b8f117dc55b3 Refactor the role/attribute member reporting code
  • d8bb23ac389929f28c584602e592b821e4c6ef9a Add an attribute reporting client PKINIT-capable servers
  • f80553208e8d9f3df422f5be8e1cafa511e1b2c4 Add the list of PKINIT servers as a virtual attribute to global config
  • 99352731b4b4bdcedfe6668ce71c1d67720ac4af Add pkinit-status command
  • 58fd229a1dbb3f00a591de9417f36197141e26d7 test_serverroles: Get rid of MockLDAP and use ldap2 instead

Metadata Update from @mbabinsk:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Lowest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.