Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1593585

Summary: Need proper default subjectDN for CMC request authenticated through SharedToken [rhel-7.5.z]
Product: Red Hat Enterprise Linux 7 Reporter: Oneata Mircea Teodor <toneata>
Component: pki-coreAssignee: Christina Fu <cfu>
Status: CLOSED ERRATA QA Contact: Asha Akkiangady <aakkiang>
Severity: urgent Docs Contact: Marc Muehlfeld <mmuehlfe>
Priority: urgent    
Version: 7.6CC: cfu, ekeck, gkapoor, mharmsen
Target Milestone: rcKeywords: TestCaseProvided, ZStream
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: pki-core-10.5.1-14.el7_5 Doc Type: Bug Fix
Doc Text:
Previously, Certificate Management over CMS (CMC) requests authenticated through a Shared Token did not supply a default subjectDN entry. Instead, the certificate signing request (CSR) provided the certificate subjectDN. However, this entry in the CSR can be different from the distinguished name (DN) of the requesting user's LDAP record. As a consequence, the subjectDN in the certificate could be incorrect. With this update, Certificate System adds the default subjectDN from the user's LDAP record. As a result, the subjectDN in the issued certificate matches the requesting user.
 Story Points: ---
Clone Of: 1592961 Environment:
Last Closed: 2018-08-16 14:20:17 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1592961    
Bug Blocks:    

Description Oneata Mircea Teodor 2018-06-21 07:24:50 UTC 
This bug has been copied from bug #1592961 and has been proposed to be backported to 7.5 z-stream (EUS).
Comment 2 Christina Fu 2018-06-21 17:36:52 UTC 
https://review.gerrithub.io/c/dogtagpki/pki/+/416056

---

commit 2d40c57887f7801f2ab0a8065b3b471bb7eafe80 (HEAD -> DOGTAG_10_5_BRANCH, origin/DOGTAG_10_5_BRANCH, gerrit/DOGTAG_10_5_BRANCH)
Author: Christina Fu <cfu>
Date:   Tue Jun 19 15:21:54 2018 -0700

    Ticket 3037 CMC SharedToken SubjectDN default
    
    This patch adds proper subjectDN to CMC requests authenticated via ShardToken.
    Specifically, the AuthTokenSubjectNameDefault profile default is added to
    the default CMC profiles that authenticates via SharedToken.
    Code were added to ensure that the proper subjectDN retrieved from the
    mapped user entry is added to the AuthToken for such utilization.
    
    Fixes https://pagure.io/dogtagpki/issue/3037
    
    Change-Id: Id92d9496ab5b41ea7b5dcffb8d73d3ffe8b29fbc
Comment 3 Christina Fu 2018-06-22 00:16:14 UTC 
Test procedure:

Set up and follow CMC Shared Token enrollment such as this:
http://www.dogtagpki.org/wiki/PKI_10.5_CMC_Shared_Token#Example_Enrollment_Procedure

Make sure when you generate the CSR, use a subjectDN that's different from the ldap user (identification)'s DN.
When specifying profileid in the servlet entry of HttpClient config file, use
   - caFullCMCSelfSignedCert.cfg for RSA
   - caECFullCMCSelfSignedCert.cfg for ECC

Once certificate is issued successfully, check that the resulting certificate contains the subjectDN that matches with the user's ldap record, and not the one specified in the CSR.

---
For negative cases:

Try using a different profile.
e.g. generate the self signed csr, etc etc...
but in Httpclient, use
servlet=/ca/ee/ca/profileSubmitUserSignedCMCFull?profileId=caECFullCMCUserSignedCert
Comment 6 Christina Fu 2018-07-24 16:31:26 UTC 
doc text looks good. thanks.
Comment 7 Geetika Kapoor 2018-07-31 14:05:30 UTC 
Hi Christina,

I have used different ldap user DN and csr subject DN.

1. Ldap user : dn: cn=user34a,ou=Groups,dc=example,dc=org
2. csr subject dn : uid=testuser-88,cn=selfsign

Actual Result: Certificate generated has subject dn == Subject: UID=testuser-88,CN=selfsign
=============

But I think expected is to have certificate generated with subject dn == ldap user dn

Below is the test procedure

Ldap entry looks like:
======================

I am searching in Groups instead of People .I have done changes in CS.cfg for that.

dn: cn=user34a,ou=Groups,dc=example,dc=org
objectClass: extensibleobject
objectClass: top
objectClass: inetorgperson
objectClass: organizationalPerson
objectClass: person
cn: user1a
sn: user1a
givenName: user1a
mail: user1a
uid: user3a
firstname: user1a
shrtoktesting: MIGVBIGAQXuw45hWJGf7rTD2ytNN+qYwEpPR6nfC197q1f2P0bStnLxLFFkFslXGlumRQgYIEvfLJZzK9Co+P3Gx7mu+IqdozC7UYsNeSkQDiOWFG6CKOGr7j7EwzHtT6WdXz2nwiT6SSbeQN/iPHF7zDfJ0L3Gs/4v9mhpd7gXLM/IQcZAEEP4BlHIW840mh+4MqKlSuVI=


Test Case 1: 
============

1. Generate csr.

PKCS10Client -d test/ -p SECret.123 -n "uid=testuser-88,cn=selfsign"  -a ec -y true -c nistp384 -o crmf2.req

2. Run CMCRequest with selfsign=true
3. Run HttpClient and use servlet=/ca/ee/ca/profileSubmitCMCFull?profileId=caECFullCMCSelfSignedCert

4. Check the CMCResponse for certificate header and subjectDN.

Certificates: 
    Certificate: 
        Data: 
            Version:  v3
            Serial Number: 0x5F
            Signature Algorithm: SHA384withEC - 1.2.840.10045.4.3.3
            Issuer: CN=Company Root CA2,O=Company,C=US
            Validity: 
                Not Before: Tuesday, July 31, 2018 9:50:44 AM EDT America/New_York
                Not  After: Sunday, January 27, 2019 9:50:44 AM EST America/New_York
            Subject: UID=testuser-88,CN=selfsign






From debug logs :

cmcRequestCertSubject=UID=testuser-88,CN=selfsign

SharedSecret.getSharedToken(String identification, IAuthToken authToken): searching for identification =user3a; mShrTokAttr =shrTokTesting
SharedSecret.getSharedToken(String identification, IAuthToken authToken): found user ldap entry: userdn = cn=user34a,ou=Groups,dc=example,dc=org
31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.profileapprovedby$ value=caadmin
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.auth_token.cmcselfsigned$ value=true
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.authenticatedname$ value=cn=user34a,ou=Groups,dc=example,dc=org
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.cert_request$ value=oIIBXwIBATCCAVgwgd8CAQAwMDERMA8GA1UEAwwIc2VsZnNpZ24xGzAZBgoJkiaJ
k/IsZAEBDAt0ZXN0dXNlci04ODB2MBAGByqGSM49AgEGBSuBBAAiA2IABE8tYIWZ
k8BYyYbfMKy2LUTflt1tUc/rrrG1sARLjJtkQQush3kD50sHASzaDspz4qI2MS4Y
9lXP6qWORx8cMGeo6FTv1v5qZoxVdn2ypS1sjZ/GNnnl8VoyAsx+VSS9+6AwMC4G
CSqGSIb3DQEJDjEhMB8wHQYDVR0OBBYEFGvSzRY+f+WqyDGTdtC6ejzCIxnfMAoG
CCqGSM49BAMCA2gAMGUCMAemNerWfKqrbP6LLr92JbFcZSxtGijw1inEtuvJ+V0e
WiZ/Ss3OaMCi+pfdbZDKsAIxANQhJestzt0wYl5w2Jvt0g6n3KopD8HcsGlBXAHD
twQ9oRXUS/VnYxa87PhXAlf0vA==

[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.profile$ value=true
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.requestversion$ value=1.0.0
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.req_subject_name.cn$ value=selfsign
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.req_locale$ value=en
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.dbstatus$ value=NOT_UPDATED
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.requeststatus$ value=begin
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.req_key$ value=MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAETy1ghZmTwFjJht8wrLYtRN+W3W1Rz+uu
sbWwBEuMm2RBC6yHeQPnSwcBLNoOynPiojYxLhj2Vc/qpY5HHxwwZ6joVO/W/mpm
jFV2fbKlLWyNn8Y2eeXxWjICzH5VJL37

[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.auth_token.authmgrinstname$ value=CMCUserSignedAuth
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.auth_token.uid$ value=$Unidentified$
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.auth_token.userid$ value=$Unidentified$
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.auth_token.cert_request_type$ value=cmc-pkcs10
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.profileid$ value=caECFullCMCSelfSignedCert
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.requestid$ value=136
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.auth_token.tokencertsubject$ value=cn=user34a,ou=Groups,dc=example,dc=org
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.auth_token.authtime$ value=1533045044159
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.req_x509info$ value=MIIBxKADAgECAgEAMAoGCCqGSM49BAMDMDoxCzAJBgNVBAYTAlVTMRAwDgYDVQQK
EwdDb21wYW55MRkwFwYDVQQDExBDb21wYW55IFJvb3QgQ0EyMB4XDTE4MDczMTEz
NTA0NFoXDTE5MDEyNzE0NTA0NFowMDERMA8GA1UEAwwIc2VsZnNpZ24xGzAZBgoJ
kiaJk/IsZAEBDAt0ZXN0dXNlci04ODB2MBAGByqGSM49AgEGBSuBBAAiA2IABE8t
YIWZk8BYyYbfMKy2LUTflt1tUc/rrrG1sARLjJtkQQush3kD50sHASzaDspz4qI2
MS4Y9lXP6qWORx8cMGeo6FTv1v5qZoxVdn2ypS1sjZ/GNnnl8VoyAsx+VSS9+6OB
pzCBpDAfBgNVHSMEGDAWgBR0EMvPl3p8ZpXkr5IQNPAlB1ayFjBSBggrBgEFBQcB
AQRGMEQwQgYIKwYBBQUHMAGGNmh0dHA6Ly9ub2NwNC5pZG0ubGFiLmVuZy5yZHUy
LnJlZGhhdC5jb206MjgwODAvY2Evb2NzcDAOBgNVHQ8BAf8EBAMCA9gwHQYDVR0l
BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME

[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.req_seq_num$ value=0
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.profilesetid$ value=cmcUserCertSet
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.req_subject_name.uid$ value=testuser-88
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.profileremoteaddr$ value=10.8.60.16
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.requesttype$ value=enrollment
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.req_extensions$ value=oyEwHzAdBgNVHQ4EFgQUa9LNFj5/5arIMZN20Lp6PMIjGd8=

[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.req_subject_name$ value=MDAxETAPBgNVBAMMCHNlbGZzaWduMRswGQYKCZImiZPyLGQBAQwLdGVzdHVzZXIt
ODg=
Comment 8 Christina Fu 2018-07-31 21:35:16 UTC 
Are you using a fresh installation with the updated profiles?
Please show me the content of caECFullCMCSelfSignedCert.cfg

Also, as a FYI, the fix (now in review) for https://bugzilla.redhat.com/show_bug.cgi?id=1601071 is on its way.
That means whatever tests you performed with this current bug in this area will need to be tested again later as code will be superseded by the new fix.

We can still continue the investigation on this though.  thanks.
Comment 9 Geetika Kapoor 2018-08-02 09:16:31 UTC 
I tried picking the new selfsigned profile and it worked.
It picks up the subject dn correctly. certificate has below mentioned inputs:

I have used different ldap user DN and csr subject DN.

Test case 1 :  Test case with profile caECFullCMCSelfSignedCert
1. Ldap user : dn: cn=user34a,ou=Groups,dc=example,dc=org
2. csr subject dn : uid=testuser-88,cn=selfsign

Output Certificate :

Certificates: 
    Certificate: 
        Data: 
            Version:  v3
            Serial Number: 0x67
            Signature Algorithm: SHA384withEC - 1.2.840.10045.4.3.3
            Issuer: CN=Company Root CA2,O=Company,C=US
            Validity: 
                Not Before: Thursday, August 2, 2018 5:03:54 AM EDT America/New_York
                Not  After: Tuesday, January 29, 2019 5:03:54 AM EST America/New_York
            Subject: CN=user34a,OU=Groups,DC=example,DC=org
            Subject Public Key Info: 
                Algorithm: EC - 1.2.840.10045.2.1
                Public Key: 



Test Case 2 : Test case with profile caFullCMCSelfSignedCert

1. Ldap user : dn: cn=user34a,ou=Groups,dc=example,dc=org
2. csr subject dn : uid=testuser-88,cn=selfsign

Output Certificate :

    Certificate: 
        Data: 
            Version:  v3
            Serial Number: 0x68
            Signature Algorithm: SHA384withEC - 1.2.840.10045.4.3.3
            Issuer: CN=Company Root CA2,O=Company,C=US
            Validity: 
                Not Before: Thursday, August 2, 2018 5:13:59 AM EDT America/New_York
                Not  After: Tuesday, January 29, 2019 5:13:59 AM EST America/New_York
            Subject: CN=user34a,OU=Groups,DC=example,DC=org
            Subject Public Key Info: 
                Algorithm: RSA - 1.2.840.113549.1.1.1
                Public Key: 
                    Exponent: 65537

Marking this bug verified. 
I'll re-test this test case again while testing fix  https://bugzilla.redhat.com/show_bug.cgi?id=1601071.
Comment 11 errata-xmlrpc 2018-08-16 14:20:17 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:2306