freeipa

#9302 "ipaKeyTrust: distrusted" breaks several update commands
Opened by cheimes. Modified

Open
Close Issue

Issue

Several places in IPA code suggests that the LDAP attribute ipaKeyTrust can be set to distrusted, e.g. certstore helpers. However there is a bug in ipapython.certdb.parse_trust_flags that breaks a server when a certificate is set to distrusted.

Steps to Reproduce

  1. Import an additional CA certificate with ipa-cacert-manage
  2. Under cn=certificates,cn=ipa,cn=etc manually set the ipaKeyTrust attribute to value distrusted
  3. run ipa-certupdate or ipa-server-upgrade

Actual behavior

ipapython.ipautil: DEBUG: args=['/usr/bin/certutil', '-d', 'sql:/etc/dirsrv/slapd-IPA-TEST', '-D', '-n', 'testca', '-f', '/etc/dirsrv/slapd-IPA-TEST/pwdfile.txt']
ipapython.ipautil: DEBUG: Process finished, return code=0
ipapython.ipautil: DEBUG: stdout=
ipapython.ipautil: DEBUG: stderr=
ipapython.admintool: DEBUG:   File "/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 180, in execute
    return_value = self.run()
  File "/usr/lib/python3.9/site-packages/ipaclient/install/ipa_certupdate.py", line 63, in run
    run_with_args(api)
  File "/usr/lib/python3.9/site-packages/ipaclient/install/ipa_certupdate.py", line 114, in run_with_args
    update_server(certs)
  File "/usr/lib/python3.9/site-packages/ipaclient/install/ipa_certupdate.py", line 171, in update_server
    update_db(paths.ETC_DIRSRV_SLAPD_INSTANCE_TEMPLATE % instance, certs)
  File "/usr/lib/python3.9/site-packages/ipaclient/install/ipa_certupdate.py", line 271, in update_db
    if flags.ca:
ipapython.admintool: DEBUG: The ipa-certupdate command failed, exception: AttributeError: 'tuple' object has no attribute 'ca'
ipapython.admintool: ERROR: 'tuple' object has no attribute 'ca'
ipapython.admintool: ERROR: The ipa-certupdate command failed.

Expected behavior

distrusted value should not break code

Version/Release/Distribution

ipa-server-4.10.0-7.el9_1.x86_64
ipa-client-4.10.0-7.el9_1.x86_64
389-ds-base-2.1.3-4.el9_1.x86_64
package pki-ca is not installed
krb5-server-1.19.1-24.el9_1.x86_64

Additional info:

The updater modifies the trust flags of a distrusted CA cert in NSSDBs and set the value to p,p,p. The if 'p' in trust_flags in parse_trust_flags returns a tuple instead of a TrustFlags object. This breaks subsequent code that assumes the function always returns a TrustFlags object.

Metadata Update from @cheimes:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/6614
- Issue assigned to cheimes
- Issue set to the milestone: FreeIPA 4.9.11
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.