freeipa

#9798 Prevent users from passing in HSM options via pki-config-override files
Closed: fixed by frenaud. Opened by rcritten.

Closed: fixed
Reopen Issue

Issue

Passing in the HSM configuration options via an override file will result in a successful, but incomplete installation.

The token name is stored within IPA but the token library path is not. Trying to override with the command-line with --token-library-path does not work.

An ldapmodify would be necessary to add the missing token library path.

Steps to Reproduce

I reproduced with this override.txt

[CA]
pki_hsm_enable = True 
pki_hsm_libfile = /usr/lib64/pkcs11/libsofthsm2.so
pki_hsm_modulename = libsofthsm2
pki_token_name = ipa_token
pki_token_password = Secret123

Actual behavior

The entry dn: cn=ipa,cn=cas,cn=ca,dc=example,dc=test will contain
ipaCaHSMConfiguration: ipa_token;None

Version/Release/Distribution

All IPA versions with HSM support

https://github.com/freeipa/freeipa/pull/7833

Fixed upstream:
master:

  • 6346ca7 Add token options to immutables for pki override

ipa-4-12:

  • 7301f00 Add token options to immutables for pki override

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

hsm

None
None
Low
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.