freeipa

#8067 add default access control configuration to trusted domain objects
Closed: fixed by tdudlak. Opened by abbra.

Closed: fixed
Reopen Issue

It looks like for some cases we do not have proper set up keytab retrieval configuration in the old trusted domain object. This mostly affects two-way trust cases. In such cases, we need to create default configuration as ipasam would have created when the trust was established.

Recently we migrated old style trusted domain objects to a new style to support one-way trust with a shared secret. We had to change that all configurations do use trusted domain object credentials instead of relying on a working cross-realm trust ticket in two-way trust case. The latter helps us against tightening of unconditional ticket delegation across cross-forest trust (after https://support.microsoft.com/en-us/help/4490425/updates-to-tgt-delegation-across-incoming-trusts-in-windows-server) which would have prevented RHEL IdM trust to AD otherwise working for two-way trust at all.

I submitted a pull request upstream that adds a default access control to new objects: https://github.com/freeipa/freeipa/pull/3643

Metadata Update from @abbra:
- Issue assigned to abbra

master:

  • 9aeb6bae23dc21b97dbd784f8d954ee0dcde1d8f add default access control when migrating trust objects
  • 0be98884991ff14720dfce428e4f23ebc4a42311 adtrust: add default read_keys permission for TDO objects

ipa-4-8:

  • 0deea83e93665404bb536d181ae54ad7cff45336 add default access control when migrating trust objects
  • b32510d67d2bd64e77659c6766d3f9647629acec adtrust: add default read_keys permission for TDO objects

Metadata Update from @tdudlak:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-7:

  • cf23e732f521f6b6dca8a3b7043cabb161dcbca9 add default access control when migrating trust objects
  • df19bf51730e1762f3c1e8a1fe196ec5c5381b98 adtrust: add default read_keys permission for TDO objects

ipa-4-6:

  • 5741e031318267b28f5812154fa34ff2ff6c3483 add default access control when migrating trust objects
  • b764b386f66fdf813f3914362985b4944c13090f adtrust: add default read_keys permission for TDO objects
  • 582e7a35121e0f5ff331699d29a485408f5e17ff Disable deprecated-lambda check in adtrust upgrade code

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1751707

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1750700 (was: https://bugzilla.redhat.com/show_bug.cgi?id=1751707)

Issue linked to Bugzilla: Bug 1750700
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.