dogtagpki

#1307 [RFE] Support multiple keySets for different cards for ExternalReg
Closed: Fixed Opened by mharmsen.

Closed: Fixed
Reopen Issue

In an effort to ensure flexibility in available card-stock to be used for
enrollment, the ability to map a users defined tokenType as set in the user
registration record in the directory with the hardware token type to allow
mapping to the appropriate TKS key set to perform operations on the card.

Problem to Solve:

When external registration is enabled, the tokenType is forced through the user
record set in the directory. This bypasses the tokenType mapping as configured
in the TPS CS.cfg based on the card CUID. This limits the ability to have a
single tokenType map to multiple hardware tokens (cards).

Requirement:

1. Populate tokenType in user record in directory.
2. Pass CUID AND tokenType to TPS
3. Continue to apply mapping for TKS key sets for hardware tokens based on CUID
and apply certificate enrollment based on tokenType.

Moving to 10.2.4 per CS team meeting.

Per Dogtag 10.2.x TRIAGE meeting of 04/28/2015: (Tech Preview Feature - 8.1.6 forward-port)

Original design of this add-on ExternalReg feature:
http://pki.fedoraproject.org/wiki/TPS_-_New_Recovery_Option:_External_Registration_DS#Supporting_multiple_keySets_for_different_cards_for_ExternalReg

pushed to master

commit fe9e2d9a677317585db34ac5131d17f696c1e09e
Author: Christina Fu cfu@redhat.com
Date: Mon May 18 16:14:47 2015 -0700

Ticket 1307 (part2 keySet mapping) [RFE] Support multiple keySets for different cards fo

commit 2e6537e80d42c208a96e218d84ed4fb5c6b7a9d4
Author: Christina Fu cfu@redhat.com
Date: Wed May 13 08:35:34 2015 -0700

Ticket 1307 (part1 refactoring) [RFE] Support multiple keySets for different cards for E

pushed to master (for regression https://bugzilla.redhat.com/show_bug.cgi?id=1202527#c4):
commit b68fc753775cf49dcd3bafe046c71dda08ca6b9a

Modified in 10.2.6-4.

minor fix pushed to master:

commit ee93ca05ec3a52fcf6239c48c167d8d5566b81cd
Author: Christina Fu cfu@redhat.com
Date: Mon Aug 24 19:00:11 2015 +0200

Ticket 1307 minor fix for - [RFE] Support multiple keySets for different cards for Extern
The earlier patch works fine for the feature requested.  However, the default
keySetMappingResolver filter contains keySet extension which would fail smart
cards.  Although this could be easily worked around, this patch provides the
default that would make it easier to play with.

After discussions in IRC on 08/26/2015, re-opening and marking critical for 10.3.

CUID range check issued pushed to master:

commit 0a97324178c8c6353e20dfe35e78699a44e89fd5
Author: Christina Fu cfu@redhat.com
Date: Wed Aug 26 09:17:55 2015 -0700

Ticket 1307 - CUID range issue for [RFE] Support multiple keySets for different cards for ExternalReg
The patch fixes an issue that the CUID comes in from the client has a different
format than that of the config cuid range strings.  With the right conversion,
the cuid range would then be evaluated correctly.  The issue may only be
discovered with certain cuid data, as it was not reproduceable in the dev
environment.

Metadata Update from @mharmsen:
- Issue assigned to cfu
- Issue set to the milestone: 10.3.0

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/1869

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Low
enhancement
TPS
RHCust
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.