[Freeipa-devel] [freeipa PR#4810][opened] fix iPAddress cert issuance for >1 host/service

[frasertweedale]

   URL: https://github.com/freeipa/freeipa/pull/4810
Author: frasertweedale
 Title: #4810: fix iPAddress cert issuance for >1 host/service
Action: opened

PR body:
"""
The 'cert_request' command accumulates DNS names from the CSR,
before checking that all IP addresses in the CSR are reachable from
those DNS names.  Before adding a DNS name to the set, we check that
that it corresponds to the FQDN of a known host/service principal
(including principal aliases).  When a DNS name maps to a
"alternative" principal (i.e.  not the one given via the 'principal'
argument), this check was not being performed correctly.
Specifically, we were looking for the 'krbprincipalname' field on
the RPC response object directly, instead of its 'result' field.

To resolve the issue, dereference the RPC response to its 'result'
field before invoking the '_dns_name_matches_principal' subroutine.

Fixes: https://pagure.io/freeipa/issue/8368
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/4810/head:pr4810
git checkout pr4810