| Summary: | Test case Failure:: CERT-9915 - RHCS-TC: Agent-Authenticated File Signing" alters file digest for "logo_header.gif" | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Geetika Kapoor <gkapoor> |
| Component: | pki-core | Assignee: | RHCS Maintainers <rhcs-maint> |
| Status: | CLOSED WONTFIX | QA Contact: | Asha Akkiangady <aakkiang> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.3 | CC: | cfu, edewata, mharmsen, msauton, prisingh, rhcs-maint, tscherf |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-11-01 03:03:05 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Geetika Kapoor
2016-09-22 06:16:21 UTC
Moving from rhel-7.3.0 ==> rhel-7.4.0 per discussions with gkapoor and aakkiang. Moved to RHEL 7.7. Description of problem: I am trying to perform the same steps but instead used httpd to host logo_header.gif image on base machine. Steps: 1. Install httpd and start the service. 2. Copy the logo_header.gif inside /var/www/html/ 3. wget http://intel-chiefriver-02.khw.lab.eng.bos.redhat.com/logo_header.gif 4. Follow the test case https://polarion.engineering.redhat.com/polarion/#/project/CERT/workitem?id=CERT-9915 Version of pki: PKI Command-Line Interface 10.5.9-6.el7 Reproduction Steps: 5. />$ sha256sum logo_header.gif 6. In the EE, Go to "Agent-Authenticated File Signing" enrollment 7. Provide the url : <http://intel-chiefriver-02.khw.lab.eng.bos.redhat.com/logo_header.gif> 8. Specify the requester name: admin and click on submit Expected Result: The digest SHA256 that is shown on EE should match with output of SHA256sum command run over the log_header.gif file. Actual Result: Getting Exception Related to missing subject name: Debug Log: [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: CMSServlet: in auditSubjectID [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: CMSServlet: auditSubjectID auditContext {sslClientCertProvider=com.netscape.cms.servlet.profile.SSLClientCertProvider@d0500c9, userid=caadmin, profileContext=com.netscape.cms.profile.common.ProfileContext@48079f0d, authManagerId=AgentCertAuth} [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: CMSServlet auditSubjectID: subjectID: caadmin [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: CertProcessor.submitRequest: calling profile submit [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: EnrollProfile: submit: begins [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: EnrollProfile: submit: popChallengeRequired =false [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: RequestRecord.loadExtDataFromRequest: missing subject name. Processing extracting subjectName from req_x509info [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: In LdapBoundConnFactory::getConn() [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: masterConn is connected: true [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: getConn: conn is connected true [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: getConn: mNumConns now 2 [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: returnConn: mNumConns now 3 [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: EnrollProfile: submit: auth token is not null [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: EnrollProfile.validate: start [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: EnrollProfile.validate: cert subject name:CN=(Name)admin(Text)(Size)1316(DigestType)SHA256(Digest)62c533044eed316b51c990e63149a6412f0ba6e9dc74ebf8cbcdec0550117706 [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: SignedAuditLogger: event PROFILE_CERT_REQUEST [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: BasicProfile: validate start on setId=serverCertSet [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: SubjectNameConstraint: validate start [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: SubjectNameConstraint: validate start [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: SubjectNameConstraint: validate cert subject =CN=(Name)admin(Text)(Size)1316(DigestType)SHA256(Digest)62c533044eed316b51c990e63149a6412f0ba6e9dc74ebf8cbcdec0550117706 [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: SubjectNameConstraint: validate() - sn500 dname = CN=(Name)admin(Text)(Size)1316(DigestType)SHA256(Digest)62c533044eed316b51c990e63149a6412f0ba6e9dc74ebf8cbcdec0550117706 [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: CertProcessor: submit Invalid Subject Name CN=(Name)admin(Text)(Size)1316(DigestType)SHA256(Digest)62c533044eed316b51c990e63149a6412f0ba6e9dc74ebf8cbcdec0550117706 [ Invalid fields: Common Name ] [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: SignedAuditLogger: event CERT_REQUEST_PROCESSED [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: RequestRecord.loadExtDataFromRequest: missing subject name. Processing extracting subjectName from req_x509info [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: In LdapBoundConnFactory::getConn() [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: masterConn is connected: true [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: getConn: conn is connected true [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: getConn: mNumConns now 2 [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: returnConn: mNumConns now 3 [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: EnrollmentSubmitter: done serving [11/Sep/2018:11:40:01][http-bio-8443-exec-17]: CMSServlet: curDate=Tue Sep 11 11:40:01 EDT 2018 id=caProfileSubmitSSLClient time=31 [11/Sep/2018:11:40:15][CRLIssuingPoint-MasterCRL]: findNextUpdate: fromLastUpdate: true delta: false [11/Sep/2018:11:40:15][CRLIssuingPoint-MasterCRL]: findNextUpdate: Tue Sep 11 11:40:15 EDT 2018 delay: 0 [11/Sep/2018:11:40:15][CRLIssuingPoint-MasterCRL]: CRLIssuingPoint:run(): before CRL generation [11/Sep/2018:11:40:15][CRLIssuingPoint-MasterCRL]: updateCRLNow: mEnable =true [11/Sep/2018:11:40:15][CRLIssuingPoint-MasterCRL]: updateCRLNow: mEnableCRLUpdates =true [11/Sep/2018:11:40:15][CRLIssuingPoint-MasterCRL]: updateCRLNow: mDoLastAutoUpdate =false [11/Sep/2018:11:40:15][CRLIssuingPoint-MasterCRL]: Updating CRL [11/Sep/2018:11:40:15][CRLIssuingPoint-MasterCRL]: findNextUpdate: fromLastUpdate: false delta: false [11/Sep/2018:11:40:15][CRLIssuingPoint-MasterCRL]: findNextUpdate: Tue Sep 11 11:41:15 EDT 2018 [11/Sep/2018:11:40:15][CRLIssuingPoint-MasterCRL]: Getting algorithm context for SHA256withRSA RSASignatureWithSHA256Digest [11/Sep/2018:11:40:15][CRLIssuingPoint-MasterCRL]: Signing Certificate [11/Sep/2018:11:40:15][CRLIssuingPoint-MasterCRL]: In LdapBoundConnFactory::getConn() [11/Sep/2018:11:40:15][CRLIssuingPoint-MasterCRL]: masterConn is connected: true [11/Sep/2018:11:40:15][CRLIssuingPoint-MasterCRL]: getConn: conn is connected true [11/Sep/2018:11:40:15][CRLIssuingPoint-MasterCRL]: getConn: mNumConns now 2 [11/Sep/2018:11:40:15][CRLIssuingPoint-MasterCRL]: ByteArrayMapper:mapObjectToLDAPAttributeSet deltaRevocationList size=506 Marc, Do we know of any customers using this feature? If not, we will create an upstream ticket and close it out on RHEL bugzilla. Thanks! Hello Fu, There is no support case attached to the bugzilla that means no customer is using this as of now. You can create upstream ticket, we will reopen this or create New bugzilla if some customer uses this feature. After evaluating this issue, there are no plans to address it further or fix it in an upcoming release. Therefore, it is being closed. If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened. |
