[sssd PR#5463][opened] Add rsassapss cert for future checks

[peptekmail]

URL: https://github.com/SSSD/sssd/pull/5463
Author: peptekmail
 Title: #5463: Add rsassapss cert for future checks
Action: opened

PR body:
"""
3rd party smartcard providers sometimes use rsassapss for signing combined with a smaller nonstandard exponent.
Unexpected characters in the commonname field creates troubles.
Add more unexpected settings to this cert to easily create future checks.
"""

To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5463/head:pr5463
git checkout pr5463

[sssd PR#5463][closed] Add rsassapss cert for future checks

[peptekmail]

URL: https://github.com/SSSD/sssd/pull/5463
Author: peptekmail
 Title: #5463: Add rsassapss cert for future checks
Action: closed

To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5463/head:pr5463
git checkout pr5463

[sssd PR#5463][comment] Add rsassapss cert for future checks

[peptekmail]

URL: https://github.com/SSSD/sssd/pull/5463
Title: #5463: Add rsassapss cert for future checks

peptekmail commented:
"""
Closed by accident, I would like to add this cert for future checks.
If it shold be fine in some other way, please let me know.
"""

See the full comment at https://github.com/SSSD/sssd/pull/5463#issuecomment-761539443

[sssd PR#5463][reopened] Add rsassapss cert for future checks

[peptekmail]

URL: https://github.com/SSSD/sssd/pull/5463
Author: peptekmail
 Title: #5463: Add rsassapss cert for future checks
Action: reopened

To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5463/head:pr5463
git checkout pr5463

[sssd PR#5463][comment] Add rsassapss cert for future checks

[sumit-bose]

URL: https://github.com/SSSD/sssd/pull/5463
Title: #5463: Add rsassapss cert for future checks

sumit-bose commented:
"""
Hi,

thanks for the patch, the tests are failing because of

```
FAIL: src/tests/whitespace_test
===============================

Trailing whitespace found:
../src/tests/test_CA/SSSD_test_cert_0007.config:23: 
FAIL src/tests/whitespace_test (exit status: 1)
```

can you remove the empty lines at the end of `SSSD_test_cert_0007.config`?

There is also the comment

```
# This certificate is used in
# - src/tests/cmocka/test_cert_utils.c
# - src/tests/cmocka/test_pam_srv.c
```

but so far the new certificate is not used in those tests. Can you add tests with this certificate as well?

bye,
Sumit

"""

See the full comment at https://github.com/SSSD/sssd/pull/5463#issuecomment-761573235

[sssd PR#5463][synchronized] Add rsassapss cert for future checks

[peptekmail]

URL: https://github.com/SSSD/sssd/pull/5463
Author: peptekmail
 Title: #5463: Add rsassapss cert for future checks
Action: synchronized

To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5463/head:pr5463
git checkout pr5463

[sssd PR#5463][comment] Add rsassapss cert for future checks

[sumit-bose]

URL: https://github.com/SSSD/sssd/pull/5463
Title: #5463: Add rsassapss cert for future checks

sumit-bose commented:
"""
Hi,

thanks for the fixes, I added another small comment.

Iirc you originally had issues with a ssh-key generated from a certificate. Did a pss certificate caused the issue? Currently it looks like SSSD is able to generate the expected ssh-key, do you still have certificates where the ssh-key generation produces unexpected results?

bye,
Sumit
"""

See the full comment at https://github.com/SSSD/sssd/pull/5463#issuecomment-762744434

[sssd PR#5463][comment] Add rsassapss cert for future checks

[Per-Erik Persson]

Hello and thanks for all the help!

I still have issues with reproducing the problem with a certificate
produced by openssl.
Producing the whole certificate with softhsm2 and p11tool and extending the
integration tests would be the next step I guess.
For obvious reasons, pushing 3rd party certificates to the repo would be a
bad idea.

On Tue, Jan 19, 2021 at 11:16 AM sumit-bose <
[e-mail]> wrote:
> URL: https://github.com/SSSD/sssd/pull/5463
> Title: #5463: Add rsassapss cert for future checks
>
> sumit-bose commented:
> """
> Hi,
>
> thanks for the fixes, I added another small comment.
>
> Iirc you originally had issues with a ssh-key generated from a
> certificate. Did a pss certificate caused the issue? Currently it looks
> like SSSD is able to generate the expected ssh-key, do you still have
> certificates where the ssh-key generation produces unexpected results?
>
> bye,
> Sumit
> """
>
> See the full comment at
> https://github.com/SSSD/sssd/pull/5463#issuecomment-762744434
> _______________________________________________
> sssd-devel mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail].o...

[sssd PR#5463][synchronized] Add rsassapss cert for future checks

[peptekmail]

URL: https://github.com/SSSD/sssd/pull/5463
Author: peptekmail
 Title: #5463: Add rsassapss cert for future checks
Action: synchronized

To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5463/head:pr5463
git checkout pr5463

[sssd PR#5463][comment] Add rsassapss cert for future checks

[sumit-bose]

URL: https://github.com/SSSD/sssd/pull/5463
Title: #5463: Add rsassapss cert for future checks

sumit-bose commented:
"""
Hi,

for some reasons your reply was only on sssd-devel. Since key and certificate were generated with special OpenSSL options I'm fine with adding this PR to the existing tests. Please send a new PR if you are able to reproduce you original issue with the certificate from the 3rd party CA.

bye,
Sumit
"""

See the full comment at https://github.com/SSSD/sssd/pull/5463#issuecomment-766931440

[sssd PR#5463][+Accepted] Add rsassapss cert for future checks

[sumit-bose]

URL: https://github.com/SSSD/sssd/pull/5463
Title: #5463: Add rsassapss cert for future checks

Label: +Accepted

[sssd PR#5463][+Ready to push] Add rsassapss cert for future checks

[pbrezina]

URL: https://github.com/SSSD/sssd/pull/5463
Title: #5463: Add rsassapss cert for future checks

Label: +Ready to push

[sssd PR#5463][-Ready to push] Add rsassapss cert for future checks

[pbrezina]

URL: https://github.com/SSSD/sssd/pull/5463
Title: #5463: Add rsassapss cert for future checks

Label: -Ready to push

[sssd PR#5463][+Ready to push] Add rsassapss cert for future checks

[pbrezina]

URL: https://github.com/SSSD/sssd/pull/5463
Title: #5463: Add rsassapss cert for future checks

Label: +Ready to push

[sssd PR#5463][comment] Add rsassapss cert for future checks

[pbrezina]

URL: https://github.com/SSSD/sssd/pull/5463
Title: #5463: Add rsassapss cert for future checks

pbrezina commented:
"""
Pushed PR: https://github.com/SSSD/sssd/pull/5463

* `master`
    * 7f3576ea3e0b70199b0b9f66f4182ce0da9db052 - Add rsassapss cert for future checks
    * 92ed415cd3139f29446879ce114fc0c1767ad5fd - Add rsassapss cert for future checks
    * 568bb1a0ffd683882fc5ad7b7f3fca40357fed1a - Add rsassapss cert for future checks

"""

See the full comment at https://github.com/SSSD/sssd/pull/5463#issuecomment-767467135

[sssd PR#5463][+Pushed] Add rsassapss cert for future checks

[pbrezina]

URL: https://github.com/SSSD/sssd/pull/5463
Title: #5463: Add rsassapss cert for future checks

Label: +Pushed

[sssd PR#5463][-Accepted] Add rsassapss cert for future checks

[pbrezina]

URL: https://github.com/SSSD/sssd/pull/5463
Title: #5463: Add rsassapss cert for future checks

Label: -Accepted

[sssd PR#5463][-Ready to push] Add rsassapss cert for future checks

[pbrezina]

URL: https://github.com/SSSD/sssd/pull/5463
Title: #5463: Add rsassapss cert for future checks

Label: -Ready to push

[sssd PR#5463][closed] Add rsassapss cert for future checks

[pbrezina]

URL: https://github.com/SSSD/sssd/pull/5463
Author: peptekmail
 Title: #5463: Add rsassapss cert for future checks
Action: closed

To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5463/head:pr5463
git checkout pr5463