Bug 1251576
| Summary: | ipa user vault access issue if created by admin | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Scott Poore <spoore> |
| Component: | doc-Linux_Domain_Identity_Management_Guide | Assignee: | Aneta Šteflová Petrová <apetrova> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Namita Soman <nsoman> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.2 | CC: | edewata, pvoborni, spoore |
| Target Milestone: | rc | Keywords: | Documentation |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-02-12 13:49:53 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1249091 | ||
| Bug Blocks: | |||
To resolve this, we could add a note about what happens when the admin creates a vault for a user (to the relevant vault procedures in chapter Storing Authentication Secrets with Vaults). Additionally, we could add a troubleshooting section (to the appendix Troubleshooting: Solutions to Specific Problems), and link to this section from the above mentioned notes. Sent for peer review. To resolve this BZ, I added: * An Important box to 25.4.1. Archiving a User's Personal Secret * A new section B.5.1. Users Cannot Access Their Vault Due To Insufficient 'add' Privilege |
Description of problem: If a user vault is created by admin for another user, there will be access control issues for the user. The users' vault container will be owned by admin and thus the user will not be able to add or access the vault. [root@master ~]# ipa vault-add --user testuser0 testuser0_vault1 ------------------------------ Added vault "testuser0_vault1" ------------------------------ Vault name: testuser0_vault1 Type: standard Owner users: admin [root@master ~]# su - testuser0 -sh-4.2$ ipa vault-add test ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add the entry 'cn=test,cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test'. Note that changing the owner of the vault, does not change the owner of the container. [root@master ~]# ipa vault-add-owner testuser0_vault1 --user=testuser0 --users=testuser0 Vault name: testuser0_vault1 Type: standard Owner users: admin, testuser0 ------------------------ Number of owners added 1 ------------------------ [root@master ~]# ipa vault-remove-owner testuser0_vault1 --user=testuser0 --users=admin Vault name: testuser0_vault1 Type: standard Owner users: testuser0 -------------------------- Number of owners removed 1 -------------------------- [root@master ~]# ldapsearch -xLLL -D 'cn=Directory Manager' -w Secret123 -b cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test cn=testuser0 dn: cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test objectClass: ipaVaultContainer objectClass: top owner: uid=admin,cn=users,cn=accounts,dc=testrelm,dc=test cn: testuser0 To avoid this issue, the user must create the vault and not the admin. To resolve the issue manually, you must make the change in LDAP for now: [root@master ~]# ldapmodify -x -D 'cn=Directory Manager' -w Secret123 <<EOF > dn: cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test > changetype: modify > replace: owner > owner: uid=testuser0,cn=users,cn=accounts,dc=testrelm,dc=test > EOF modifying entry "cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test" Version-Release number of selected component (if applicable): ipa-server-4.2.0-3.el7.x86_64 pki-ca-10.2.5-4.el7.noarch How reproducible: always I think Steps to Reproduce: 1. Install IPA server(ipa-server-install) 2. Install KRA (ipa-kra-install) 3. ipa user-add testuser --password 4. kdestroy -A; kinit testuser 5. kdestroy -A; kinit admin 6. ipa vault-add --user=testuser testvault 7. su - testuser 8. kinit testuser 9. ipa vault-add testvault2 Actual results: Insufficient access error Expected results: Must create first vault as user then access error should not occur. Additional info: