Description Philipp Hahn 2017-12-12 18:37:35 CET

This is a paint for each technical training, as SSO does not work out-of-the-box.

(In reply to Felix Botner from comment #6)
> Man kann zwar mit 
> 
> certutil -A -n "Univention Corporate Server Root CA (ID=UE3v6YLl)" \
>  -t "CT,C,C" -i /etc/univention/ssl/ucsCA/CAcert.pem \
>  -d /root/.mozilla/firefox/gqxg88b8.default/
> 
> ein Zertifikat importieren, jedoch nur in ein bestehendes Profil. Es ist
> nicht klar, wie man dem Firefox hier Vorgaben für Benutzerdefaults machen
> kann, und nur wenn das für das Zertifikat irgendwie ginge, macht das Ganze
> Sinn.

See <https://wiki.mozilla.org/CA:AddRootToFirefox#AutoConfig_via_JavaScript>

This works:

cat >/etc/firefox-esr/mozilla.cfg <<__CFG__
// required comment in first line
var Cc = Components.classes;
var Ci = Components.interfaces;
var certdb = Cc["@mozilla.org/security/x509certdb;1"].getService(Ci.nsIX509CertDB);
var certdb2 = certdb;
try {
   certdb2 = Cc["@mozilla.org/security/x509certdb;1"].getService(Ci.nsIX509CertDB2);
} catch (e) {}
cert = "$(grep -v -e ^- /etc/univention/ssl/ucsCA/CAcert.pem | tr -d '\n')";
certdb.addCertFromBase64(cert, "C,C,C", "");
__CFG__

cat >/etc/firefox-esr/0univention.js <<__CFG__
// required comment in first line
pref("general.config.obscure_value", 0);
pref("general.config.filename", "mozilla.cfg"); # Required until Bug #45863 gets fixed
__CFG__

ln -s /etc/firefox-esr/mozilla.cfg /usr/lib/firefox-esr/mozilla.cfg
# If Bug #45863 is fixed:
ucr set firefox/prefs/conffile=mozilla.cfg
ln -snf pref/firefox-esr.js /etc/firefox-esr/univention.js


Task #9484: UCS Technical Training 2017-12-1[23]