Bug 1251579
| Summary: | ipa vault-add --user should set container owner equal to user on first run | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Scott Poore <spoore> |
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> |
| Status: | CLOSED ERRATA | QA Contact: | Namita Soman <nsoman> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.2 | CC: | edewata, pvoborni, rcritten |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-4.2.0-5.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-11-19 12:05:09 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Scott Poore
2015-08-07 19:15:15 UTC
Clarification, the problem is with the vault container ownership, not the vault itself. A private vault container should be owned by the user/service (just like a home directory), but the vault itself should still be owned by the creator (just like a file). An admin may want to create an admin-owned vault for a user in which the user is only a member. If necessary later the admin can transfer the ownership to the user using the vault-add-owner command. Upstream ticket: https://fedorahosted.org/freeipa/ticket/5194 Upstream ticket: https://fedorahosted.org/freeipa/ticket/5194 Fixed upstream master: https://fedorahosted.org/freeipa/changeset/419754b1c11139435ae5b5082a51026da0d5e730 ipa-4-2: https://fedorahosted.org/freeipa/changeset/e110f6da2f42c4cd52ae73c7aad2421559da56a2 Verified. Version :: ipa-server-4.2.0-5.el7.x86_64 Results :: [root@master ipa]# ipa user-add newuser First name: adsf Last name: asdf -------------------- Added user "newuser" -------------------- User login: newuser First name: adsf Last name: asdf Full name: adsf asdf Display name: adsf asdf Initials: aa Home directory: /home/newuser GECOS: adsf asdf Login shell: /bin/sh Kerberos principal: newuser Email address: newuser UID: 744800003 GID: 744800003 Password: False Member of groups: ipausers Kerberos keys available: False [root@master ipa]# ipa-kra-install Directory Manager password: =================================================================== This program will setup Dogtag KRA for the IPA Server. Configuring KRA server (pki-tomcatd). Estimated time: 2 minutes 6 seconds [1/7]: configuring KRA instance [2/7]: add RA user to KRA agent group [3/7]: restarting KRA [4/7]: configure certmonger for renewals [5/7]: configure certificate renewals [6/7]: configure HTTP to proxy connections [7/7]: add vault container Done configuring KRA server (pki-tomcatd). Restarting the directory server The ipa-kra-install command was successful [root@master ipa]# ipa vault-add testvault --user=newuser ----------------------- Added vault "testvault" ----------------------- Vault name: testvault Type: standard Owner users: admin Vault user: newuser [root@master ipa]# ldapsearch -xLLL -D "cn=Directory Manager" -w Secret123 -b cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test cn=newuser dn: cn=newuser,cn=users,cn=vaults,cn=kra,dc=testrelm,dc=test objectClass: ipaVaultContainer objectClass: top owner: uid=newuser,cn=users,cn=accounts,dc=testrelm,dc=test cn: newuser Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2362.html |