Code Monkey home page Code Monkey logo

custodia.ipa's People

Contributors

tiran avatar

Stargazers

avatar

Watchers

avatar avatar avatar avatar avatar avatar

Forkers

tiran

custodia.ipa's Issues

Potential race condition in cert request

The cert request and caching code is subject to a potential race condition. There is no locking in place that prevents issuing of multiple certs for the same service. In case a replication controller schedules multiple instances of a pod on multiple nodes at the same time, IPACertRequest may request multiple certificates in parallel.

Document that IPAVault needs KRA

KRA needs to be configured with ipa-kra-install. I'm not sure if KRA needs to be available on all CA replicas or if FreeIPA finds any available KRA in the cluster by itself.

Plugin raises CCacheError error when TGT has expired

It looks like GSSAPI does not auto-refresh a TGT with client keytab when the TGT is expired:

2017-04-13 13:38:12 - custodia                         - Custodia debug logger enabled
2017-04-13 13:38:12 - custodia                         - Custodia audit log: /tmp/audit.log
2017-04-13 13:38:12 - custodia                         - Config file <closed file 'custodia.conf', mode 'r' at 0x7f025fc29660> loaded
2017-04-13 13:38:13 - IPAInterface-[auth:ipa]          - Unable to get principal from GSSAPI. Are you missing a TGT or valid Kerberos keytab?
Traceback (most recent call last):
  File "/tmp/venv/bin/custodia", line 11, in <module>
    sys.exit(main())
  File "/tmp/venv/lib/python2.7/site-packages/custodia/server/__init__.py", line 211, in main
    _load_plugins(config, cfgparser)
  File "/tmp/venv/lib/python2.7/site-packages/custodia/server/__init__.py", line 191, in _load_plugins
    raise RuntimeError(menu, name, e)
RuntimeError: ('authenticators', 'ipa', CCacheError(u'Major (720896): The referenced credential has expired, Minor (100001): Success',))

$ klist
Ticket cache: FILE:/tmp/ccache
Default principal: custodia/[email protected]

Valid starting       Expires              Service principal
2017-04-12 13:07:18  2017-04-13 13:07:18  krbtgt/[email protected]
2017-04-12 13:07:39  2017-04-13 13:07:18  HTTP/[email protected]

Check validity of cached cert

IPACertRequest.get does not validate if a cached cert is still valid. It should perform at least two tests:

  • check the status of the certificate in IPA. The cert may have been revoked by an admin through web interface of ipa tool.
  • check expiration date is below a configurable threshold, e.g. still usable for 30 days.

Optimize list()

The list() operation simply grabs a list of all available vaults from the server. That doesn't scale well. Find a way to optimize it.

Don't log to file

By default, ipalib creates a file handler and writes all log messages to ~/.ipa/log/default.log (or whatever the context is). The log file is not auto-rotated or shrinked. File logging can be disable with bootstrap(log=None).

Map `ACIError: Insufficient access` to 404

When principal has no permission to set or get an entry, FreeIPA fails with an exception like

ACIError: Insufficient access: Insufficient 'add' privilege to add the entry 'cn=keys__secrets__test10,cn=custodia/[email protected],cn=services,cn=vaults,cn=kra,dc=ipa,dc=example'

custodia.ipa should map the exception to HTTP 404 error.

Look for a proper way to handle NSS_STRICT_NOFORK

https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Reference/NSS_environment_variables

It is an error to try to use a PKCS#11 crypto module in a process before it has been initialized in that process, even if the module was initialized in the parent process. Beginning in NSS 3.12.3, Softoken will detect this error. This environment variable controls Softoken's response to that error.

    If set to to "1" or unset, Softoken will trigger an assertion failure in debug builds, and will report an error in non-DEBUG builds.
    If set  to "DISABLED", Softoken will ignore forks, and behave as it did in older versions.
    If set to any other non-empty value, Softoken will report an error in both DEBUG and non-DEBUG builds.

Perhaps python-nss has a way to init the crypto module again?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.