search

redhat-qe-security / SCAutolib

Library for automation of smart card testing
GNU General Public License v3.0
3 stars 10 forks source link

Fix obtaining of ipa script for smart card setup to the client host #40

Closed x00Pavel closed 2 years ago

x00Pavel commented 2 years ago

There was a problem with obtaining the script generated by ipa-advise command. Admin password for obtaining Kerberos ticket was passed in the wrong way, so there was an error, and the script was not generated, so the final file didn't contain any code to execute. This causes file /etc/sssd/pki/sssd_auth_ca_db.pem (this file has to be updated in the obtained script) does not contain IPA CA certificate or does not exist at all after prepare command is finished. As file /etc/sssd/pki/sssd_auth_ca_db.pem is essential for smart card authentication due to certificates storied in it, smart card login was failing.

What is updated:

  1. Size of the final file is checked based on the return value of os.stat(file), not based on empty contact (file.read() return an empty string)
  2. ssh stdout is not read before password with trialing new line (\n) symbol is passed to the ssh stdin