Latest patches attached. Relative to previous patchset this one: - fixes a compile error in CATest.java - fixes a ton of warnings and some poorly ordered imports - adds ACLs and ACL enforcement for privileged operations on AuthorityResource Here's an ldif snippet for adding the ACLs to an existing database dn: cn=aclResources,o=ipaca changetype: modify add: resourceACLS resourceACLS: certServer.ca.authorities:list,read:allow (list,read) user="anybody":Anybody may list and read lightweight authorities resourceACLS: certServer.ca.authorities:create,modify:allow (create,modify) group="Administrators":Administrators may create and modify lightweight authorities Cheers, Fraser On Fri, Sep 18, 2015 at 02:11:27PM -0500, Endi Sukma Dewata wrote:
On 9/18/2015 1:46 PM, Ade Lee wrote:
6. Assuming authority DN is unique, we can add --issuer <DN> option tothese commands: * pki ca-cert-find --issuer <dn> * pki ca-cert-request-submit --issuer <dn> * pki client-cert-find --issuer <dn> * pki client-cert-request --issuer <dn>
If we do this, then we need to be sure that the DN is normalized - both on input -- ie. when the subca is created (we need to do this in any case) and also on processing in the CLI.
I'm ok with offering this as an option (maybe --issuer_dn), but the primary (and initially required option) will be using UUID. We can defer this mechanism to another ticket/patch. Please open one.
Per IRC discussion we agreed with these options: * --issuer-id <ID> * --issuer-dn <DN> to be added to the ca-cert-* and client-cert-request commands.
For the client-cert-find command we can only provide this option: * --issuer-dn <DN> since issuer ID is irrelevant on the client.
Personally I think the issuer DN would be more useful since that's the value that you see in certificates, so it's more consistent everywhere, and no need to do a lookup to find the issuer ID. Also, although most likely we will copy & paste the ID or DN anyway, the DN is easier to read and confirm that you're submitting the request to the right authority.
-- Endi S. Dewata