Bug 1075118

Thanks for report, I can also reproduce. Adding more data

7.0 replica httpd access_log:
...
10.16.78.57 - - [11/Mar/2014:11:34:08 -0400] "GET /ca/rest/securityDomain/domainInfo HTTP/1.1" 200 236
10.16.78.57 - - [11/Mar/2014:11:34:09 -0400] "GET /ca/rest/account/login HTTP/1.1" 403 272


7.0 replica /var/log/pki/pki-tomcat/ca/system:
...
28495.ajp-bio-127.0.0.1-8009-exec-2 - [11/Mar/2014:11:34:09 EDT] [13] [6] checkPermission(): permission denied for the resource certServer.ca.account on operation login
28495.ajp-bio-127.0.0.1-8009-exec-2 - [11/Mar/2014:11:34:09 EDT] [13] [3] Authorization Failed

Nathan, Ade or Rob - any idea what could cause this one? I am also CCing Jan to help with this case.

Is this the same as the other issue you reported with AVC messages when creating a replica?

    https://bugzilla.redhat.com/show_bug.cgi?id=1075153

If it's not the same, do you see any AVC messages for this issue?

when installing rhel7 replica - the AVCs mentioned in bz1075153 were seen. 

Then this SAME rhel7 ipa server was used to generate replica pkg and install a new rhel7 replica

I can reproduce this issue even with SELinux to permissive, I do not think this is solely caused by SELinux (though I agree that potential SELinux issues should be fixed).

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/4243

I was now working Endi on investigating the issue in my VMs and Endi discovered that there some ACLs missing (cn=aclResources,o=ipaca) due to incomplete update of the PKI database to Dogtag 10 level.

This is something I would like have investigated further and decide what we would do for 7.0, I see 2 options:

1) Fix pkispawn so that when Dogtag 10 clone is being created and it detects this is a Dogtag 9 DB, it adds missing ACL items or other entries required for Dogtag 10 function. This precludes that these changes do not destroy PKI on RHEL-6.

2) Do not fix anything in 7.0 and just add a new step to the migration procedure so that admin needs to run ldapmodify to add the missing Dogtag 10 DB himself as a requirement to be able install additional Dogtag 10 clone (not my favorite option).

As Martin mentioned, Dogtag 10 (RHEL 7) requires some additional ACL entries, but currently there is no automatic mechanism to upgrade Dogtag 9 (RHEL 6.5) database, so the entries have to be added manually with this command:

$ ldapmodify -h `hostname` -D "cn=Directory Manager" -w <password> -x
dn: cn=aclResources,o=ipaca
changetype: modify
add: resourceACLS
resourceACLS: certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout
resourceACLS: certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations
resourceACLS: certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations
resourceACLS: certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations
resourceACLS: certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations
-
delete: resourceACLS
resourceACLS: certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group":Anybody is allowed to read domain.xml but only Subsystem group is allowed to modify the domain.xml
-
add: resourceACLS
resourceACLS: certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group" || group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators":Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml
-
delete: resourceACLS
resourceACLS: certServer.ca.connectorInfo:read,modify:allow (modify,read) group="Enterprise KRA Administrators":Only Enterprise Administrators are allowed to update the connector information
-
add: resourceACLS
resourceACLS: certServer.ca.connectorInfo:read,modify:allow (read) group="Enterprise KRA Administrators";allow (modify) group="Enterprise KRA Administrators" || group="Subsystem Group":Only Enterprise Administrators and Subsystem Group are allowed to update the connector information

Note that in order to run this command, the base DN must match the existing tree, and the delete operations must match the current content. Also, since the database is replicated, this command should only be executed once. Additional testing may be needed to verify that the older Dogtag (RHEL 6.5) will continue to run with the upgraded database.

I can confirm I was repeatedly able to install IPA replica when these ACLs were fixed. I did basic tests of requesting certificates in both Dogtag 9 and Dogtag 10 based replicas and it worked. I also tried installing IPA client for both D9 and D10 replicas and certmonger correctly retrieved the client certificate.

So now we just need to fix pkispawn to migrate the ACLs when it detects they are not there.

Removing needinfo? - we already identified this is not caused by SELinux.

After discussion, we chose to do the ACL updates in IPA replica installer. This will fix the issue for the short term.

The long term fix will be used when database migration scripts are added in PKI:

https://fedorahosted.org/pki/ticket/710 (database upgrade framework)
https://fedorahosted.org/pki/ticket/906 (checking database version)

Fixed upstream
master:
https://fedorahosted.org/freeipa/changeset/b3c2197b7e4ed18a7febe3efa6396c2272ebccca
ipa-3-3:
https://fedorahosted.org/freeipa/changeset/9bc032f9ec0c44e83550d6f87f72e9395c3093d9

Verified. Now replica install is successful with replica file created on migrated replica on RHEL-7.0 from RHEL-6.5 based IPA installation.

IPA Version:
============
[root@rhel70-replica ~]# rpm -q ipa-server pki-ca
ipa-server-3.3.3-25.el7.x86_64
pki-ca-10.0.5-3.el7.noarch
[root@rhel70-replica ~]#

Please find the attached console output.

Created attachment 875921 [details]
console output of ipa replica install

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.