Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
If a user vault is created by admin for another user, there will be access control issues for the user. The users' vault container will be owned by admin and thus the user will not be able to add or access the vault.
[root@master ~]# ipa vault-add --user testuser0 testuser0_vault1
------------------------------
Added vault "testuser0_vault1"
------------------------------
Vault name: testuser0_vault1
Type: standard
Owner users: admin
[root@master ~]# su - testuser0
-sh-4.2$ ipa vault-add test
ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add the entry 'cn=test,cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test'.
Note that changing the owner of the vault, does not change the owner of the container.
[root@master ~]# ipa vault-add-owner testuser0_vault1 --user=testuser0 --users=testuser0
Vault name: testuser0_vault1
Type: standard
Owner users: admin, testuser0
------------------------
Number of owners added 1
------------------------
[root@master ~]# ipa vault-remove-owner testuser0_vault1 --user=testuser0 --users=admin
Vault name: testuser0_vault1
Type: standard
Owner users: testuser0
--------------------------
Number of owners removed 1
--------------------------
[root@master ~]# ldapsearch -xLLL -D 'cn=Directory Manager' -w Secret123 -b cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test cn=testuser0
dn: cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test
objectClass: ipaVaultContainer
objectClass: top
owner: uid=admin,cn=users,cn=accounts,dc=testrelm,dc=test
cn: testuser0
To avoid this issue, the user must create the vault and not the admin.
To resolve the issue manually, you must make the change in LDAP for now:
[root@master ~]# ldapmodify -x -D 'cn=Directory Manager' -w Secret123 <<EOF
> dn: cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test
> changetype: modify
> replace: owner
> owner: uid=testuser0,cn=users,cn=accounts,dc=testrelm,dc=test
> EOF
modifying entry "cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test"
Version-Release number of selected component (if applicable):
ipa-server-4.2.0-3.el7.x86_64
pki-ca-10.2.5-4.el7.noarch
How reproducible:
always I think
Steps to Reproduce:
1. Install IPA server(ipa-server-install)
2. Install KRA (ipa-kra-install)
3. ipa user-add testuser --password
4. kdestroy -A; kinit testuser
5. kdestroy -A; kinit admin
6. ipa vault-add --user=testuser testvault
7. su - testuser
8. kinit testuser
9. ipa vault-add testvault2
Actual results:
Insufficient access error
Expected results:
Must create first vault as user then access error should not occur.
Additional info:
Comment 2Aneta Šteflová Petrová
2017-02-21 15:24:06 UTC
To resolve this, we could add a note about what happens when the admin creates a vault for a user (to the relevant vault procedures in chapter Storing Authentication Secrets with Vaults).
Additionally, we could add a troubleshooting section (to the appendix Troubleshooting: Solutions to Specific Problems), and link to this section from the above mentioned notes.
Comment 3Aneta Šteflová Petrová
2018-01-17 09:40:21 UTC
Sent for peer review.
Comment 10Aneta Šteflová Petrová
2018-02-07 08:47:52 UTC
To resolve this BZ, I added:
* An Important box to 25.4.1. Archiving a User's Personal Secret
* A new section B.5.1. Users Cannot Access Their Vault Due To Insufficient 'add' Privilege
Comment 12Aneta Šteflová Petrová
2018-02-12 13:49:53 UTC
Description of problem: If a user vault is created by admin for another user, there will be access control issues for the user. The users' vault container will be owned by admin and thus the user will not be able to add or access the vault. [root@master ~]# ipa vault-add --user testuser0 testuser0_vault1 ------------------------------ Added vault "testuser0_vault1" ------------------------------ Vault name: testuser0_vault1 Type: standard Owner users: admin [root@master ~]# su - testuser0 -sh-4.2$ ipa vault-add test ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add the entry 'cn=test,cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test'. Note that changing the owner of the vault, does not change the owner of the container. [root@master ~]# ipa vault-add-owner testuser0_vault1 --user=testuser0 --users=testuser0 Vault name: testuser0_vault1 Type: standard Owner users: admin, testuser0 ------------------------ Number of owners added 1 ------------------------ [root@master ~]# ipa vault-remove-owner testuser0_vault1 --user=testuser0 --users=admin Vault name: testuser0_vault1 Type: standard Owner users: testuser0 -------------------------- Number of owners removed 1 -------------------------- [root@master ~]# ldapsearch -xLLL -D 'cn=Directory Manager' -w Secret123 -b cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test cn=testuser0 dn: cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test objectClass: ipaVaultContainer objectClass: top owner: uid=admin,cn=users,cn=accounts,dc=testrelm,dc=test cn: testuser0 To avoid this issue, the user must create the vault and not the admin. To resolve the issue manually, you must make the change in LDAP for now: [root@master ~]# ldapmodify -x -D 'cn=Directory Manager' -w Secret123 <<EOF > dn: cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test > changetype: modify > replace: owner > owner: uid=testuser0,cn=users,cn=accounts,dc=testrelm,dc=test > EOF modifying entry "cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test" Version-Release number of selected component (if applicable): ipa-server-4.2.0-3.el7.x86_64 pki-ca-10.2.5-4.el7.noarch How reproducible: always I think Steps to Reproduce: 1. Install IPA server(ipa-server-install) 2. Install KRA (ipa-kra-install) 3. ipa user-add testuser --password 4. kdestroy -A; kinit testuser 5. kdestroy -A; kinit admin 6. ipa vault-add --user=testuser testvault 7. su - testuser 8. kinit testuser 9. ipa vault-add testvault2 Actual results: Insufficient access error Expected results: Must create first vault as user then access error should not occur. Additional info: