Details
-
Improvement
-
Status: Closed
-
Normal
-
Resolution: Fixed
-
None
-
None
-
None
-
- Add auth rules for certificate_status and certificate_statuses allowing access to them via a speical auth extension
- Add said auth extension to master cert generated by the server
-
Froyo
-
Needs Assessment
Description
The new CA CLI needs access to the certificate_status(es) endpoint. In Puppet Server 5, this endpoint is currently blocked under a deny-all rule in tk-auth. In Puppet 6 we made it accessible to a certificate with a special auth extension, then adding this extension to the master cert that is generated by Puppet Server. We should backport these improvements to Puppet Server 5 so that the gem is fully usable out of the box.
Attachments
Issue Links
- relates to
-
SERVER-2287 The master cert created by `generate` should have custom extensions for the `cert_status` endpoint auth
-
- Closed
-
-
SERVER-2308 Update puppetserver's CA bootstrapping code to add CLI tool auth extension
-
- Closed
-