Bug 1477318

Summary: CA and TPS audit log messages should mention the key size info during token enrollment
Product: Red Hat Enterprise Linux 8 Reporter: Roshni <rpattath>
Component: pki-coreAssignee: RHCS Maintainers <rhcs-maint>
Status: CLOSED NOTABUG QA Contact: Asha Akkiangady <aakkiang>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 8.3CC: cfu, mharmsen
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-02-11 20:22:27 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Roshni 2017-08-01 18:58:32 UTC 
Description of problem:
CA and TPS audit log messages should mention the key size info during token enrollment

Version-Release number of selected component (if applicable):
pki-ca-10.4.1-11.el7.noarch
pki-tps-10.4.1-10.el7pki.x86_64

How reproducible:
always

Steps to Reproduce:
1. Perform a smartcard enrollment
2.
3.

Actual results:

CA audit log messages

0.http-bio-21443-exec-16 - [01/Aug/2017:14:28:53 EDT] [14] [6] [AuditEvent=PROFILE_CERT_REQUEST][SubjectID=TPS-nocp1.idm.lab.eng.rdu2.redhat.com-25443][Outcome=Success][ReqID=79][ProfileID=caTokenUserEncryptionKeyEnrollment][CertSubject=UID=scuser1,O=Token Key User] certificate request made with certificate profiles
0.http-bio-21443-exec-16 - [01/Aug/2017:14:28:53 EDT] [14] [6] [AuditEvent=CERT_REQUEST_PROCESSED][SubjectID=TPS-nocp1.idm.lab.eng.rdu2.redhat.com-25443][Outcome=Success][ReqID=79][CertSerialNum=16151503] certificate request processed

TPS audit log:

0.http-bio-25080-exec-1 - [01/Aug/2017:14:28:43 EDT] [14] [6] [[AuditEvent=TOKEN_CERT_ENROLLMENT][IP=10.13.129.77][SubjectID=scuser1][CUID=4090614575C1240E0327][Outcome=success][tokenType=userKey][KeyVersion=0101][Serial=217734641][CA_ID=ca1][Info=null] token certificate enrollment request made
0.http-bio-25080-exec-1 - [01/Aug/2017:14:28:53 EDT] [14] [6] [[AuditEvent=TOKEN_CERT_ENROLLMENT][IP=10.13.129.77][SubjectID=scuser1][CUID=4090614575C1240E0327][Outcome=success][tokenType=userKey][KeyVersion=0101][Serial=16151503][CA_ID=ca1][Info=null] token certificate enrollment request made

Expected results:
key size information should be stored in the audit log messages

Additional info:
Comment 2 Matthew Harmsen 2017-10-25 16:29:23 UTC 
[20171025] - RHEL 7.5 / RHCS 9.3 pre-Alpha Offline Triage ==> 7.6
Comment 3 Matthew Harmsen 2018-04-18 02:37:13 UTC 
Per RHEL 7.5.z/7.6/8.0 Triage:  7.6

jmagne: low hanging and kind of useful info for audit log.
Comment 4 Matthew Harmsen 2018-07-04 00:25:58 UTC 
Moved to RHEL 7.7.
Comment 5 Christina Fu 2020-02-09 18:42:22 UTC 
I"m not sure where the requirement comes from irt cert request records having to contain key size info.
The Common Criteria pp_ca_v2.1 only states that for cert issuance, one could provide a link to the cert request.  In our case, we provide the cert request ID, which serves as a valid "link" to the actual cert request record, which contains all the info needed, including key size.

TPS is different in a way that it is an RA, which in success case, should contain serial number (which appears to be the case) and will properly link to the CA audit then cert request record.
In the failure case, in my opinion, it should contain a cert request id (if it got that far); otherwise there's not much one could do.

I don't see any TPS enrollment failure example in the description so I can't say if it has it or not.
Comment 6 Christina Fu 2020-02-11 20:22:27 UTC 
per meeting discussion today.  We will close this as not a bug.  Feel free to open with explanation if disagree.