[PATCH] pki-cfu-0095-Ticket-1543-portalEnroll-authentication-does-not-loa.patch
Ticket 1543 portalEnroll authentication does not load during creation from Console https://fedorahosted.org/pki/ticket/1543 It appears that the PortalEnroll plugin was never converted to work in the Profile Framework. This patch takes out the following line from CS.cfg: auths.impl.PortalEnroll.class=com.netscape.cms.authentication.PortalEnroll so that it cannot be instantiated from the console, nor manually in CS.cfg, unless explicitly put back in. While in CS.cfg.in, I found the NSSAuth auths.impl line having no real implementation, so I remove that too. thanks, Christina
now with the patch... On 08/12/2015 10:17 AM, Christina Fu wrote:
Ticket 1543 portalEnroll authentication does not load during creation from Console https://fedorahosted.org/pki/ticket/1543
It appears that the PortalEnroll plugin was never converted to work in the Profile Framework. This patch takes out the following line from CS.cfg: auths.impl.PortalEnroll.class=com.netscape.cms.authentication.PortalEnroll
so that it cannot be instantiated from the console, nor manually in CS.cfg, unless explicitly put back in. While in CS.cfg.in, I found the NSSAuth auths.impl line having no real implementation, so I remove that too.
thanks, Christina
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
This looks like a good solution at this point in time. ACK I would suggest we investigate the possibility of permanently ripping this thing out or actually fixing it and file the appropriate ticket. ----- Original Message ----- From: "Christina Fu" <cfu@redhat.com> To: "pki-devel" <pki-devel@redhat.com> Sent: Wednesday, August 12, 2015 10:45:57 AM Subject: Re: [Pki-devel] [PATCH] pki-cfu-0095-Ticket-1543-portalEnroll-authentication-does-not-loa.patch now with the patch... On 08/12/2015 10:17 AM, Christina Fu wrote:
Ticket 1543 portalEnroll authentication does not load during creation from Console https://fedorahosted.org/pki/ticket/1543
It appears that the PortalEnroll plugin was never converted to work in the Profile Framework. This patch takes out the following line from CS.cfg: auths.impl.PortalEnroll.class=com.netscape.cms.authentication.PortalEnroll
so that it cannot be instantiated from the console, nor manually in CS.cfg, unless explicitly put back in. While in CS.cfg.in, I found the NSSAuth auths.impl line having no real implementation, so I remove that too.
thanks, Christina
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
I tried the patch and looked at the code. Functionally, the non-hash option works, but for security reasons, please make the hashed option work as well, and make sure hashed option is on by default. thanks, Christina On 08/12/2015 10:56 AM, John Magne wrote:
This looks like a good solution at this point in time.
ACK
I would suggest we investigate the possibility of permanently ripping this thing out or actually fixing it and file the appropriate ticket.
----- Original Message ----- From: "Christina Fu" <cfu@redhat.com> To: "pki-devel" <pki-devel@redhat.com> Sent: Wednesday, August 12, 2015 10:45:57 AM Subject: Re: [Pki-devel] [PATCH] pki-cfu-0095-Ticket-1543-portalEnroll-authentication-does-not-loa.patch
now with the patch...
On 08/12/2015 10:17 AM, Christina Fu wrote:
Ticket 1543 portalEnroll authentication does not load during creation from Console https://fedorahosted.org/pki/ticket/1543
It appears that the PortalEnroll plugin was never converted to work in the Profile Framework. This patch takes out the following line from CS.cfg: auths.impl.PortalEnroll.class=com.netscape.cms.authentication.PortalEnroll
so that it cannot be instantiated from the console, nor manually in CS.cfg, unless explicitly put back in. While in CS.cfg.in, I found the NSSAuth auths.impl line having no real implementation, so I remove that too.
thanks, Christina
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
I just found out the reason why the hashed versions were not working was that I chose the wrong syntax oid for the "pin" attribute. Noriko suggested an appropriate one and all is working now. Revised patch to come soon. ----- Original Message ----- From: "John Magne" <jmagne@redhat.com> To: "Christina Fu" <cfu@redhat.com> Cc: "pki-devel" <pki-devel@redhat.com> Sent: Wednesday, August 12, 2015 10:56:09 AM Subject: Re: [Pki-devel] [PATCH] pki-cfu-0095-Ticket-1543-portalEnroll-authentication-does-not-loa.patch This looks like a good solution at this point in time. ACK I would suggest we investigate the possibility of permanently ripping this thing out or actually fixing it and file the appropriate ticket. ----- Original Message ----- From: "Christina Fu" <cfu@redhat.com> To: "pki-devel" <pki-devel@redhat.com> Sent: Wednesday, August 12, 2015 10:45:57 AM Subject: Re: [Pki-devel] [PATCH] pki-cfu-0095-Ticket-1543-portalEnroll-authentication-does-not-loa.patch now with the patch... On 08/12/2015 10:17 AM, Christina Fu wrote:
Ticket 1543 portalEnroll authentication does not load during creation from Console https://fedorahosted.org/pki/ticket/1543
It appears that the PortalEnroll plugin was never converted to work in the Profile Framework. This patch takes out the following line from CS.cfg: auths.impl.PortalEnroll.class=com.netscape.cms.authentication.PortalEnroll
so that it cannot be instantiated from the console, nor manually in CS.cfg, unless explicitly put back in. While in CS.cfg.in, I found the NSSAuth auths.impl line having no real implementation, so I remove that too.
thanks, Christina
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
Patch again with the hashes working now. ----- Original Message ----- From: "John Magne" <jmagne@redhat.com> To: "Christina Fu" <cfu@redhat.com> Cc: "pki-devel" <pki-devel@redhat.com> Sent: Wednesday, August 12, 2015 6:55:34 PM Subject: Re: [Pki-devel] [PATCH] pki-cfu-0095-Ticket-1543-portalEnroll-authentication-does-not-loa.patch I just found out the reason why the hashed versions were not working was that I chose the wrong syntax oid for the "pin" attribute. Noriko suggested an appropriate one and all is working now. Revised patch to come soon. ----- Original Message ----- From: "John Magne" <jmagne@redhat.com> To: "Christina Fu" <cfu@redhat.com> Cc: "pki-devel" <pki-devel@redhat.com> Sent: Wednesday, August 12, 2015 10:56:09 AM Subject: Re: [Pki-devel] [PATCH] pki-cfu-0095-Ticket-1543-portalEnroll-authentication-does-not-loa.patch This looks like a good solution at this point in time. ACK I would suggest we investigate the possibility of permanently ripping this thing out or actually fixing it and file the appropriate ticket. ----- Original Message ----- From: "Christina Fu" <cfu@redhat.com> To: "pki-devel" <pki-devel@redhat.com> Sent: Wednesday, August 12, 2015 10:45:57 AM Subject: Re: [Pki-devel] [PATCH] pki-cfu-0095-Ticket-1543-portalEnroll-authentication-does-not-loa.patch now with the patch... On 08/12/2015 10:17 AM, Christina Fu wrote:
Ticket 1543 portalEnroll authentication does not load during creation from Console https://fedorahosted.org/pki/ticket/1543
It appears that the PortalEnroll plugin was never converted to work in the Profile Framework. This patch takes out the following line from CS.cfg: auths.impl.PortalEnroll.class=com.netscape.cms.authentication.PortalEnroll
so that it cannot be instantiated from the console, nor manually in CS.cfg, unless explicitly put back in. While in CS.cfg.in, I found the NSSAuth auths.impl line having no real implementation, so I remove that too.
thanks, Christina
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel _______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
sorry I missed seeing this earlier... but could you replace the sha1 and md5 with sha2 instead? thanks, Christina On 08/12/2015 07:07 PM, John Magne wrote:
Patch again with the hashes working now.
----- Original Message ----- From: "John Magne" <jmagne@redhat.com> To: "Christina Fu" <cfu@redhat.com> Cc: "pki-devel" <pki-devel@redhat.com> Sent: Wednesday, August 12, 2015 6:55:34 PM Subject: Re: [Pki-devel] [PATCH] pki-cfu-0095-Ticket-1543-portalEnroll-authentication-does-not-loa.patch
I just found out the reason why the hashed versions were not working was that I chose the wrong syntax oid for the "pin" attribute. Noriko suggested an appropriate one and all is working now. Revised patch to come soon.
----- Original Message ----- From: "John Magne" <jmagne@redhat.com> To: "Christina Fu" <cfu@redhat.com> Cc: "pki-devel" <pki-devel@redhat.com> Sent: Wednesday, August 12, 2015 10:56:09 AM Subject: Re: [Pki-devel] [PATCH] pki-cfu-0095-Ticket-1543-portalEnroll-authentication-does-not-loa.patch
This looks like a good solution at this point in time.
ACK
I would suggest we investigate the possibility of permanently ripping this thing out or actually fixing it and file the appropriate ticket.
----- Original Message ----- From: "Christina Fu" <cfu@redhat.com> To: "pki-devel" <pki-devel@redhat.com> Sent: Wednesday, August 12, 2015 10:45:57 AM Subject: Re: [Pki-devel] [PATCH] pki-cfu-0095-Ticket-1543-portalEnroll-authentication-does-not-loa.patch
now with the patch...
On 08/12/2015 10:17 AM, Christina Fu wrote:
Ticket 1543 portalEnroll authentication does not load during creation from Console https://fedorahosted.org/pki/ticket/1543
It appears that the PortalEnroll plugin was never converted to work in the Profile Framework. This patch takes out the following line from CS.cfg: auths.impl.PortalEnroll.class=com.netscape.cms.authentication.PortalEnroll
so that it cannot be instantiated from the console, nor manually in CS.cfg, unless explicitly put back in. While in CS.cfg.in, I found the NSSAuth auths.impl line having no real implementation, so I remove that too.
thanks, Christina
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
We have been updating the wrong email, but subject name fixed. The latest patch now gives us a sha256 hash for the pins and sha1 and md5 are gone as options. The back end gets a minor addition where it can deal with a sha256 has when verifying the pin. ----- Original Message ----- From: "John Magne" <jmagne@redhat.com> To: "Christina Fu" <cfu@redhat.com> Cc: "pki-devel" <pki-devel@redhat.com> Sent: Wednesday, August 12, 2015 7:07:59 PM Subject: Re: [Pki-devel] [PATCH] pki-cfu-0095-Ticket-1543-portalEnroll-authentication-does-not-loa.patch Patch again with the hashes working now. ----- Original Message ----- From: "John Magne" <jmagne@redhat.com> To: "Christina Fu" <cfu@redhat.com> Cc: "pki-devel" <pki-devel@redhat.com> Sent: Wednesday, August 12, 2015 6:55:34 PM Subject: Re: [Pki-devel] [PATCH] pki-cfu-0095-Ticket-1543-portalEnroll-authentication-does-not-loa.patch I just found out the reason why the hashed versions were not working was that I chose the wrong syntax oid for the "pin" attribute. Noriko suggested an appropriate one and all is working now. Revised patch to come soon. ----- Original Message ----- From: "John Magne" <jmagne@redhat.com> To: "Christina Fu" <cfu@redhat.com> Cc: "pki-devel" <pki-devel@redhat.com> Sent: Wednesday, August 12, 2015 10:56:09 AM Subject: Re: [Pki-devel] [PATCH] pki-cfu-0095-Ticket-1543-portalEnroll-authentication-does-not-loa.patch This looks like a good solution at this point in time. ACK I would suggest we investigate the possibility of permanently ripping this thing out or actually fixing it and file the appropriate ticket. ----- Original Message ----- From: "Christina Fu" <cfu@redhat.com> To: "pki-devel" <pki-devel@redhat.com> Sent: Wednesday, August 12, 2015 10:45:57 AM Subject: Re: [Pki-devel] [PATCH] pki-cfu-0095-Ticket-1543-portalEnroll-authentication-does-not-loa.patch now with the patch... On 08/12/2015 10:17 AM, Christina Fu wrote:
Ticket 1543 portalEnroll authentication does not load during creation from Console https://fedorahosted.org/pki/ticket/1543
It appears that the PortalEnroll plugin was never converted to work in the Profile Framework. This patch takes out the following line from CS.cfg: auths.impl.PortalEnroll.class=com.netscape.cms.authentication.PortalEnroll
so that it cannot be instantiated from the console, nor manually in CS.cfg, unless explicitly put back in. While in CS.cfg.in, I found the NSSAuth auths.impl line having no real implementation, so I remove that too.
thanks, Christina
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel _______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
participants (2)
-
Christina Fu -
John Magne