From c309d4a4d0c19df80808b2ce9352ce2af2a30a3c Mon Sep 17 00:00:00 2001 From: Fraser Tweedale Date: Thu, 28 May 2020 12:10:22 +1000 Subject: [PATCH] acme: add Dogtag ACL to allow ACME agents to revoke certs Add an ACL to allow ACME agents to revoke certificates. Although the operation "execute" sounds quite scary (as though it would have a wide scope), in fact it only allows revocation (and unrevocation). See CertResource.java and base/ca/shared/conf/acl.properties in the Dogtag source. Part of: https://pagure.io/freeipa/issue/4751 Reviewed-By: Rob Crittenden --- ipaserver/install/cainstance.py | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py index e11b5e05c..5ddec3273 100644 --- a/ipaserver/install/cainstance.py +++ b/ipaserver/install/cainstance.py @@ -1533,6 +1533,8 @@ class CAInstance(DogtagInstance): logger.debug('ACME service is already deployed') return False + configure_acme_acls() + # create ACME agent group (if not exist already) and user self.ensure_group(ACME_AGENT_GROUP, "ACME RA accounts") acme_user = f"acme-{self.fqdn}" @@ -1857,6 +1859,21 @@ def configure_lightweight_ca_acls(): return __add_acls(new_rules) +def configure_acme_acls(): + """Allow the ACME Agents to modify profiles.""" + + # The "execute" operation sounds scary, but it actually only allows + # revocation and unrevocation. See CertResource.java and + # base/ca/shared/conf/acl.properties in the Dogtag source. + + new_rules = [ + 'certServer.ca.certs:execute' + f':allow (execute) group="{ACME_AGENT_GROUP}"' + ':ACME Agents may execute cert operations', + ] + return __add_acls(new_rules) + + def __add_acls(new_rules): """Add the given Dogtag ACLs.