{"push_id":1467795060,"size":1,"distinct_size":1,"ref":"refs/heads/master","head":"bdbb1c34a2f5ef864cd3a943dcd047cde20de681","before":"2bc01ec5b4a91a805912bdada429a91ab08ed196","commits":[{"sha":"bdbb1c34a2f5ef864cd3a943dcd047cde20de681","author":{"name":"Fraser Tweedale","email":"779a3224d9bbeae15f3568d667f61bf5739b7bdb@redhat.com"},"message":"Remove \"Request Certificate with SubjectAltName\" permission\n\nsubjectAltName is required or relevant in most certificate use cases\n(esp. TLS, where carrying DNS name in Subject DN CN attribute is\ndeprecated).  Therefore it does not really make sense to have a\nspecial permission for this, over and above \"request certificate\"\npermission.\n\nFurthermore, we already do rigorously validate SAN contents again\nthe subject principal, and the permission is waived for self-service\nrequests or if the operator is a host principal.\n\nSo remove the permission, the associated virtual operation, and the\nassociated code in cert_request.\n\nFixes: https://fedorahosted.org/freeipa/ticket/6526\nReviewed-By: Martin Babinsky <mbabinsk@redhat.com>","distinct":true,"url":"https://api.github.com/repos/freeipa/freeipa/commits/bdbb1c34a2f5ef864cd3a943dcd047cde20de681"}]}
{"actor":{"display_login":"bastiak"}}