Description of problem:

If a user vault is created by admin for another user, there will be access control issues for the user.  The users' vault container will be owned by admin and thus the user will not be able to add or access the vault.

[root@master ~]# ipa vault-add --user testuser0 testuser0_vault1
------------------------------
Added vault "testuser0_vault1"
------------------------------
  Vault name: testuser0_vault1
  Type: standard
  Owner users: admin

[root@master ~]# su - testuser0

-sh-4.2$ ipa vault-add  test
ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add the entry 'cn=test,cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test'.


Note that changing the owner of the vault, does not change the owner of the container.

[root@master ~]# ipa vault-add-owner testuser0_vault1 --user=testuser0 --users=testuser0
  Vault name: testuser0_vault1
  Type: standard
  Owner users: admin, testuser0
------------------------
Number of owners added 1
------------------------

[root@master ~]# ipa vault-remove-owner testuser0_vault1 --user=testuser0 --users=admin
  Vault name: testuser0_vault1
  Type: standard
  Owner users: testuser0
--------------------------
Number of owners removed 1
--------------------------

[root@master ~]# ldapsearch -xLLL -D 'cn=Directory Manager' -w Secret123 -b cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test cn=testuser0
dn: cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test
objectClass: ipaVaultContainer
objectClass: top
owner: uid=admin,cn=users,cn=accounts,dc=testrelm,dc=test
cn: testuser0

To avoid this issue, the user must create the vault and not the admin.  

To resolve the issue manually, you must make the change in LDAP for now:

[root@master ~]# ldapmodify -x -D 'cn=Directory Manager' -w Secret123 <<EOF
> dn: cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test
> changetype: modify
> replace: owner
> owner: uid=testuser0,cn=users,cn=accounts,dc=testrelm,dc=test
> EOF
modifying entry "cn=testuser0,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test"


Version-Release number of selected component (if applicable):
ipa-server-4.2.0-3.el7.x86_64
pki-ca-10.2.5-4.el7.noarch


How reproducible:
always I think

Steps to Reproduce:
1.  Install IPA server(ipa-server-install)
2.  Install KRA (ipa-kra-install)
3.  ipa user-add testuser --password
4.  kdestroy -A; kinit testuser
5.  kdestroy -A; kinit admin
6.  ipa vault-add --user=testuser testvault
7.  su - testuser
8.  kinit testuser
9.  ipa vault-add testvault2

Actual results:

Insufficient access error

Expected results:

Must create first vault as user then access error should not occur.

Additional info: