RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1251579 - ipa vault-add --user should set container owner equal to user on first run
Summary: ipa vault-add --user should set container owner equal to user on first run
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.2
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Namita Soman
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-08-07 19:15 UTC by Scott Poore
Modified: 2015-11-19 12:05 UTC (History)
3 users (show)

Fixed In Version: ipa-4.2.0-5.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-11-19 12:05:09 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:2362 0 normal SHIPPED_LIVE ipa bug fix and enhancement update 2015-11-19 10:40:46 UTC

Description Scott Poore 2015-08-07 19:15:15 UTC 
Description of problem:

Right now if you run vault-add --user=testuser as admin, the owner is set to admin.  I think it would be preferable to set this to the user from --user option.



Here is an example:

[root@master ~]# ipa vault-add new_test_vault --user=testuser
----------------------------
Added vault "new_test_vault"
----------------------------
  Vault name: new_test_vault
  Type: standard
  Owner users: admin

[root@master ~]# ldapsearch -xLLL -D 'cn=Directory Manager' -w Secret123 -b cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test cn=testuser
dn: cn=testuser,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test
objectClass: ipaVaultContainer
objectClass: top
owner: uid=admin,cn=users,cn=accounts,dc=testrelm,dc=test
cn: testuser

This has the potential to cause problems described in the doc bug #1251576

Version-Release number of selected component (if applicable):
ipa-server-4.2.0-3.el7.x86_64
pki-ca-10.2.5-4.el7.noarch


How reproducible:
always

Steps to Reproduce:
1.  Install IPA Server (ipa-server-insipa-server-4.2.0-3.el7.x86_64
pki-ca-10.2.5-4.el7.noarch
tall)
2.  Install KRA (ipa-kra-install)
3.  Add user
ipa user-add newuser 

4.  Add vault for user as admin
ipa vault-add testvault --user=newuser

Actual results:
Owner of new vault is admin

Expected results:
Owner of new vault should be newuser

Additional info:
Comment 2 Endi Sukma Dewata 2015-08-10 19:33:16 UTC 
Clarification, the problem is with the vault container ownership, not the vault itself. A private vault container should be owned by the user/service (just like a home directory), but the vault itself should still be owned by the creator (just like a file). An admin may want to create an admin-owned vault for a user in which the user is only a member. If necessary later the admin can transfer the ownership to the user using the vault-add-owner command.

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/5194
Comment 3 Petr Vobornik 2015-08-10 21:06:39 UTC 
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/5194
Comment 4 Petr Vobornik 2015-08-18 10:28:10 UTC 
Fixed upstream
master:
https://fedorahosted.org/freeipa/changeset/419754b1c11139435ae5b5082a51026da0d5e730
ipa-4-2:
https://fedorahosted.org/freeipa/changeset/e110f6da2f42c4cd52ae73c7aad2421559da56a2
Comment 6 Scott Poore 2015-08-21 01:41:53 UTC 
Verified.

Version ::

ipa-server-4.2.0-5.el7.x86_64

Results ::

[root@master ipa]# ipa user-add newuser
First name: adsf
Last name: asdf
--------------------
Added user "newuser"
--------------------
  User login: newuser
  First name: adsf
  Last name: asdf
  Full name: adsf asdf
  Display name: adsf asdf
  Initials: aa
  Home directory: /home/newuser
  GECOS: adsf asdf
  Login shell: /bin/sh
  Kerberos principal: newuser
  Email address: newuser
  UID: 744800003
  GID: 744800003
  Password: False
  Member of groups: ipausers
  Kerberos keys available: False

[root@master ipa]# ipa-kra-install
Directory Manager password: 


===================================================================
This program will setup Dogtag KRA for the IPA Server.


Configuring KRA server (pki-tomcatd). Estimated time: 2 minutes 6 seconds
  [1/7]: configuring KRA instance
  [2/7]: add RA user to KRA agent group
  [3/7]: restarting KRA
  [4/7]: configure certmonger for renewals
  [5/7]: configure certificate renewals
  [6/7]: configure HTTP to proxy connections
  [7/7]: add vault container
Done configuring KRA server (pki-tomcatd).
Restarting the directory server
The ipa-kra-install command was successful

[root@master ipa]# ipa vault-add testvault --user=newuser
-----------------------
Added vault "testvault"
-----------------------
  Vault name: testvault
  Type: standard
  Owner users: admin
  Vault user: newuser

[root@master ipa]# ldapsearch -xLLL -D "cn=Directory Manager" -w Secret123 -b cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test cn=newuser
dn: cn=newuser,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test
objectClass: ipaVaultContainer
objectClass: top
owner: uid=newuser,cn=users,cn=accounts,dc=testrelm,dc=test
cn: newuser
Comment 7 errata-xmlrpc 2015-11-19 12:05:09 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2362.html
Note You need to log in before you can comment on or make changes to this bug.