Jira (PUP-6166) Authorization Certificate Extensions

[Reid Vandewiele (JIRA)]

Title: Message Title

Reid Vandewiele updated an issue   Puppet / PUP-6166 Authorization Certificate Extensions Change By: Reid Vandewiele Provide a clean mechanism for setting certificate extensions to be used for cert-based authorizations (e.g. in TK-293). This mechanism needs to be different from our existing certificate extensions due to the need to prevent authorization-granting certificates from being accidentally signed. The logical way to do this is to create a new OID arc specifically for authorization-granting extensions. Our root OID is 1.3.6.1.4.1.34380 for "puppetlabs". We then have: {noformat} puppetlabs.1:   "Puppet Certificate Extension" puppetlabs.1.1: "Puppet Registered Certificate Extension" (ppRegCertExt) puppetlabs.1.2: "Puppet Private Certificate Extension"    (ppPrivCertExt) {noformat} See details [here|https://github.com/puppetlabs/puppet/blob/master/lib/puppet/ssl/oids.rb#L28-L61]. Our CA will currently ONLY accept extension requests if they are under one of the existing ppRegCertExt or ppPrivCertExt OIDs. See [ here the ruby code |https://github.com/puppetlabs/puppet/blob/master/lib/puppet/ssl/certificate_authority.rb#L325-L329]  and [the clojure code|https://github . com/puppetlabs/puppet-server/blob/master/src/clj/puppetlabs/puppetserver/certificate_authority.clj#L550-L568]. To implement "authorization" certificate extensions, we could define another OID arc under puppetlabs.1. For example, we could define: {noformat} puppetlabs.1.3: "Puppet Authorization Certificate Extension" (ppAuthCertExt) {noformat} Because any extensions under this OID are flatline rejected today, we have full control over how we implement the methodology for accepting them. We could require on the command line something like: {code} puppet cert sign --allow-authorization-extensions {code} Add Comment   This message was sent by Atlassian JIRA (v6.4.13#64028-sha1:b7939e9) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.