search

freeipa / freeipa-healthcheck

Check the health of a freeIPA installation
GNU General Public License v3.0
50 stars 28 forks source link

Support validating LWCA certmonger requests #308

Closed rcritten closed 1 year ago

rcritten commented 1 year ago

The LWCA ids are UUID4 format and are stored in LDAP so we can retrieve the list (ignoring the ipa entry) and construct what the request should look like.

Fixes: https://github.com/freeipa/freeipa-healthcheck/issues/307

rcritten commented 1 year ago

While developing the original patch I noticed that cn=cas was being hammered. It was because the call to cert_find included all=True which was confusing the cache. We in fact don't need all attributes. This increased the cache hits from 7 to 24.

rcritten commented 1 year ago

Switched from caching only the LWCA requests to all expected requests. This saves a fair bit of effort and a few potential LDAP calls.

rcritten commented 1 year ago

Huh. I'd have sworn I was logging the LWCA search result as debug and not warn. I'll fix that up and drop the "failed" bit. The search succeeded but returned nothing.