freeipa

0 Fork 0

Files

T

Rob Crittenden a16dc59447 Set the ACME baseURL in order to pin a client to a single IPA server

ACME uses nonce values to prevent replay attacks. Since the
ipa-ca name can go to any of the IPA servers in order to verify the
nonce the servers need to know the value that was set which
relies on replication. Sometimes the client is faster than
replication so a request can fail.

This change returns the baseURL to the client as the name of the
ACME server during discovery which should pin all requests to this
one IPA server and alleviate the replication issue.

Signed-off-by: Rob Crittenden <rcritten@redhat.com>

https://pagure.io/freeipa/issue/8712

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>

2021-02-15 13:11:56 +02:00

certmonger

Improve performance of ipa-server-guard

2020-08-19 13:59:11 -04:00

custodia

Replace PYTHONSHEBANG with valid shebang

2019-06-24 09:35:57 +02:00

html

Change FreeIPA references to IPA and Identity Management

2021-02-09 09:48:23 -05:00

migration

Change FreeIPA references to IPA and Identity Management

2021-02-09 09:48:23 -05:00

oddjob

use a constant instead of /var/lib/sss/keytabs

2021-01-22 21:10:58 -05:00

restart_scripts

Don't create log files from help scripts

2019-09-24 15:23:30 +02:00

Set the ACME baseURL in order to pin a client to a single IPA server

2021-02-15 13:11:56 +02:00

tools

Change FreeIPA references to IPA and Identity Management

2021-02-09 09:48:23 -05:00

WebUI: change FreeIPA naming to IPA in About dialog

2021-02-15 10:02:58 +02:00

updates

ipasam: implement PASSDB getgrnam call

2021-01-22 21:10:58 -05:00

wsgi

wgi/plugins.py: ignore empty plugin directories

2020-11-06 16:38:37 -05:00

Makefile.am

Move Custodia secrets handler to scripts

2019-04-26 12:09:22 +02:00

README.schema

Add some basic rules for adding new schema

2010-08-27 13:40:37 -04:00

README.schema

Ground rules on adding new schema

Brand new schema, particularly when written specifically for IPA, should be
added in share/*.ldif. Any new files need to be explicitly loaded in
ipaserver/install/dsinstance.py. These simply get copied directly into
the new instance schema directory.

Existing schema (e.g. in an LDAP draft) may either be added as a separate
ldif in share or as an update in the updates directory. The advantage of
adding the schema as an update is if 389-ds ever adds the schema then the
installation won't fail due to existing schema failing to load during
bootstrap.

If the new schema requires a new container then this should be added
to install/bootstrap-template.ldif.