Bug 1863616

Summary:	CA-less install does not set required permissions on KDC certificate
Product:	Red Hat Enterprise Linux 8	Reporter:	Florence Blanc-Renaud <frenaud>
Component:	ipa	Assignee:	Thomas Woerner <twoerner>
Status:	CLOSED ERRATA	QA Contact:	ipa-qe <ipa-qe>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.3	CC:	ksiddiqu, mpolovka, myusuf, pcech, pvoborni, rcritten, tscherf
Target Milestone:	rc	Keywords:	Regression, TestCaseProvided, Triaged
Target Release:	8.0	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-4.8.7-9.el8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-11-04 02:51:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Florence Blanc-Renaud 2020-08-03 17:01:50 UTC

This bug is created as a clone of upstream ticket:
https://pagure.io/freeipa/issue/8440

### Issue
When ipa server/replica is installed in CA-less mode with a KDC certificate, the KDC cert is installed in /var/kerberos/krb5kdc/kdc.crt but the permissions are left as 0600 and this breaks WebUI authentication

#### Steps to Reproduce
1. install CA_less ipa server with ipa-server-install [...] --pkinit-cert-file /path/to/kdc.p12
2. check the permissions on /var/kerberos/krb5kdc/kdc.crt
3. install CA-less ipa replica with ipa-replica-install [...] --pkinit-cert-file /path/to/kdc.p12
4. check the permissions on /var/kerberos/krb5kdc/kdc.crt

#### Actual behavior
The file has 600 root:root permissions. Connection to the WebGUI fails.

#### Expected behavior
The file should have 644 root:root permissions. Connection to the WebGUI should succeed.

Comment 1 Florence Blanc-Renaud 2020-08-03 17:05:16 UTC

Upstream PR: https://github.com/freeipa/freeipa/pull/4974

Comment 2 Petr Vobornik 2020-08-03 18:07:28 UTC

Adding a Regression Keyword. Password authentication to Web UI in CA less mode used to work in a past. Don't know in what release it got broken though.

Comment 3 Rob Crittenden 2020-08-03 22:02:27 UTC

Fixed upstream
master:
https://pagure.io/freeipa/c/9335bd9299e54928a057cbd31de40aca0ef207b2
https://pagure.io/freeipa/c/a26e0ba558aa76323d90b807f2201992d6ee58b4

Comment 4 Florence Blanc-Renaud 2020-08-04 06:40:14 UTC

Fixed upstream
ipa-4-6:
https://pagure.io/freeipa/c/9c9b9fd5854badc3fa65bbda7648cacbb35b0436
https://pagure.io/freeipa/c/87ba8c50d79526021e938c0fcf8150d7a342c863

Comment 5 Florence Blanc-Renaud 2020-08-04 07:57:23 UTC

Fixed upstream
ipa-4-8:
https://pagure.io/freeipa/c/81c955e561dd42ab70a39bf636c90e82a9d7d899
https://pagure.io/freeipa/c/295dd4235f693b7b4b4270b46a28cb6e7b3d00b4

Comment 6 Florence Blanc-Renaud 2020-08-04 07:59:16 UTC

Test case provided in ipatests/test_integration/test_caless.py::TestPKINIT

Comment 15 Mohammad Rizwan 2020-08-19 14:33:33 UTC

With 4.8.7.9.module+el8.3.0+7664+fa35cfe6 automated test passed. report.html is attached.

Marking the bug as verified.

Comment 16 Serhii Tsymbaliuk 2020-08-28 07:51:09 UTC

*** Bug 1826382 has been marked as a duplicate of this bug. ***

Comment 19 errata-xmlrpc 2020-11-04 02:51:20 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:4670