Bug 1251576 - ipa user vault access issue if created by admin
ipa user vault access issue if created by admin
Status: NEW
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: doc-Linux_Domain_Identity_Management_Guide (Show other bugs)
7.2
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Aneta Šteflová Petrová
Namita Soman
: Documentation, EasyFix
Depends On: 1249091
Blocks:
  Show dependency treegraph
 
Reported: 2015-08-07 14:55 EDT by Scott Poore
Modified: 2017-02-28 10:22 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Scott Poore 2015-08-07 14:55:04 EDT
Description of problem:

If a user vault is created by admin for another user, there will be access control issues for the user.  The users' vault container will be owned by admin and thus the user will not be able to add or access the vault.

[root@master ~]# ipa vault-add --user testuser0 testuser0_vault1
------------------------------
Added vault "testuser0_vault1"
------------------------------
  Vault name: testuser0_vault1
  Type: standard
  Owner users: admin

[root@master ~]# su - testuser0

-sh-4.2$ ipa vault-add  test
ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add the entry 'cn=test,cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test'.


Note that changing the owner of the vault, does not change the owner of the container.

[root@master ~]# ipa vault-add-owner testuser0_vault1 --user=testuser0 --users=testuser0
  Vault name: testuser0_vault1
  Type: standard
  Owner users: admin, testuser0
------------------------
Number of owners added 1
------------------------

[root@master ~]# ipa vault-remove-owner testuser0_vault1 --user=testuser0 --users=admin
  Vault name: testuser0_vault1
  Type: standard
  Owner users: testuser0
--------------------------
Number of owners removed 1
--------------------------

[root@master ~]# ldapsearch -xLLL -D 'cn=Directory Manager' -w Secret123 -b cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test cn=testuser0
dn: cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test
objectClass: ipaVaultContainer
objectClass: top
owner: uid=admin,cn=users,cn=accounts,dc=testrelm,dc=test
cn: testuser0

To avoid this issue, the user must create the vault and not the admin.  

To resolve the issue manually, you must make the change in LDAP for now:

[root@master ~]# ldapmodify -x -D 'cn=Directory Manager' -w Secret123 <<EOF
> dn: cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test
> changetype: modify
> replace: owner
> owner: uid=testuser0,cn=users,cn=accounts,dc=testrelm,dc=test
> EOF
modifying entry "cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test"


Version-Release number of selected component (if applicable):
ipa-server-4.2.0-3.el7.x86_64
pki-ca-10.2.5-4.el7.noarch


How reproducible:
always I think

Steps to Reproduce:
1.  Install IPA server(ipa-server-install)
2.  Install KRA (ipa-kra-install)
3.  ipa user-add testuser --password
4.  kdestroy -A; kinit testuser
5.  kdestroy -A; kinit admin
6.  ipa vault-add --user=testuser testvault
7.  su - testuser
8.  kinit testuser
9.  ipa vault-add testvault2

Actual results:

Insufficient access error

Expected results:

Must create first vault as user then access error should not occur.

Additional info:
Comment 2 Aneta Šteflová Petrová 2017-02-21 10:24:06 EST
To resolve this, we could add a note about what happens when the admin creates a vault for a user (to the relevant vault procedures in chapter Storing Authentication Secrets with Vaults).

Additionally, we could add a troubleshooting section (to the appendix Troubleshooting: Solutions to Specific Problems), and link to this section from the above mentioned notes.

Note You need to log in before you can comment on or make changes to this bug.