freeipa

#9270 ipa certmap-match does not work for hosts
Opened by cheimes. Modified

Open
Close Issue

Issue

The "ipa certmap-match" command is a debug tool to test if a certificate matches a certmap rule. It returns a list of users that maps the certificate. In FreeIPA 4.9.10 and earlier the tool does not work for host entries.

While this feature is not strictly necessary for us, it is a very useful debug tool. There is no other easy way to investigate issues with cert mappings or host entries. kinit with PKINIT can be used, however there is a gotcha: The KDC caches certmap rules for 5 minutes. Any change to a rule requires a restart of the KDC or 5 minutes of waiting.

Steps to Reproduce

  1. create a cert mapping that maps certificate to host entries
  2. verify that PKINIT can be used to get a TGT for a host with cert/key pair
  3. attempt to match cert to host with ipa certmap-match cert.pem

Actual behavior

The certmap-match command returns 0 matches.

Expected behavior

The certmap-match returns the matching host entry

Version/Release/Distribution

freeipa-server-4.9.10-4.fc36.x86_64

Additional info:

See https://bugzilla.redhat.com/show_bug.cgi?id=2075452 for a use case for PKINIT with host certs.

Alexander, Sumit, and I discussed the issue internally. The fix may require a new API in SSSD. The certmap-match command uses SSSD D-Bus API /org/freedesktop/sssd/infopipe/Users to match certs to users. AFAIK there is no general API that matches hosts or service accounts.

SSSD ticket is https://github.com/SSSD/sssd/issues/6423

Metadata Update from @ftrivino:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2075452
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.