ACMEAccountService fixes/enhancements #4625
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
frasertweedale
commented
Nov 28, 2023
•
frasertweedale
commented
ACMEAccountService currently throws an uncaught exception if decode the account object payload fails. This results in the server responding 500 Internal Server Error. Respond with status 400 and a proper problem document instead.
Some ACME clients POST-as-GET the account resource, expecting to receive the account object (for an existing account). In particular, mod_md does this and certificate renewal fails when it cannot read or verify the account information. The ACME protocol does not explicitly require this behaviour. But on the other hand, it is not surprising that clients assume they can do it, and it arguably is surprising if an ACME server does not provide it. So let's implement it. The change itself is trivial: when payload is empty, POST-as-GET is implied (RFC 8555 section 6.3). In this case, return the ACMEAccount object (which we already have at hand) unchanged.
|
Kudos, SonarCloud Quality Gate passed! |
frasertweedale
force-pushed
the
fix/acme-get-account
branch
from
e2046ef
to
ed31277
Compare
|
There is a KRA failure but I do not see links with the changes in this PR so I would accept and investigate that problem in separate PR |
|
The KRA failure disappeared after I restarted the test. |
edewata
approved these changes
Nov 29, 2023
There was a problem hiding this comment.
The patch looks good. Once it's merged to master branch this patch will be included in the next build in Fedora 40, RHEL 9.4/10, and RHCS 10.6. About backporting, I don't think this is needed in older RHCS versions and IIUC ACME will remain a tech preview in RHEL 8. But if IPA needs it in older RHEL versions, we can certainly backport the patch and create a new build, just file a RHEL Jira ticket for that.
|
@frasertweedale @edewata Thanks! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.