Bug 1284803 - Default CA ACL rule is not created during ipa-replica-install
Default CA ACL rule is not created during ipa-replica-install
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa (Show other bugs)
All Linux
urgent Severity urgent
: rc
: ---
Assigned To: IPA Maintainers
Namita Soman
: ZStream
Depends On: 1283429
  Show dependency treegraph
Reported: 2015-11-24 04:37 EST by Jan Kurik
Modified: 2016-01-20 08:01 EST (History)
9 users (show)

See Also:
Fixed In Version: ipa-4.2.0-15.el7_2.2
Doc Type: Bug Fix
Doc Text:
Included certificate profiles and CA ACLs were not added during replica installation. As a consequence, certificate issuance failed on Red Hat Enterprise Linux 7.2 IdM replicas created from IdM masters prior to 7.2. Now, certificate profiles and CA ACLs are in place. Additionally, the default CA ACL cannot be deleted. As a result, certificate profiles and CA ACLs are now added if missing when installing a replica regardless of the version of the IdM master. The default CA ACL, hosts_services_caIPAserviceCert, can no longer be deleted, only disabled.
Story Points: ---
Clone Of: 1283429
Last Closed: 2015-12-08 05:37:44 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Jan Kurik 2015-11-24 04:37:34 EST
This bug has been copied from bug #1283429 and has been proposed
to be backported to 7.2 z-stream (EUS).
Comment 5 Kaleem 2015-11-25 03:41:11 EST
CA ACL now added on migrated replica and getcert/cert-request are successful.

IPA Version:
[root@vm-idm-006 ~]# rpm -q ipa-server pki-ca
[root@vm-idm-006 ~]# 

Console output:
[root@vm-idm-006 ~]# mkdir /tmp/test1
[root@vm-idm-006 ~]# chcon -t cert_t /tmp/test1/
[root@vm-idm-006 ~]# ipa-getcert request -k /tmp/test1/test1.key -f /tmp/test1/test1.crt -I testing1 
New signing request "testing1" added.
[root@vm-idm-006 ~]# ipa-getcert list -i testing1 
Number of certificates and requests being tracked: 9.
Request ID 'testing1':
	stuck: no
	key pair storage: type=FILE,location='/tmp/test1/test1.key'
	certificate: type=FILE,location='/tmp/test1/test1.crt'
	issuer: CN=Certificate Authority,O=TESTRELM.TEST
	subject: CN=vm-idm-006.testrelm.test,O=TESTRELM.TEST
	expires: 2017-11-25 08:28:29 UTC
	dns: vm-idm-006.testrelm.test
	principal name: host/vm-idm-006.testrelm.test@TESTRELM.TEST
	key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
	eku: id-kp-serverAuth,id-kp-clientAuth
	pre-save command: 
	post-save command: 
	track: yes
	auto-renew: yes
[root@vm-idm-006 ~]# ipa caacl-find
1 CA ACL matched
  ACL name: hosts_services_caIPAserviceCert
  Enabled: TRUE
  Host category: all
  Service category: all
  Profiles: caIPAserviceCert
Number of entries returned 1
[root@vm-idm-006 ~]# 
[root@vm-idm-006 ~]# mkdir /tmp/cert-request-test/
[root@vm-idm-006 ~]# chcon -t cert_t /tmp/cert-request-test/
[root@vm-idm-006 ~]# openssl req -out /tmp/cert-request-test/request1.csr -new -newkey rsa:1024 -nodes -keyout /tmp/cert-request-test/request1.prv
Generating a 1024 bit RSA private key
writing new private key to '/tmp/cert-request-test/request1.prv'
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [XX]:IN
State or Province Name (full name) []:MH
Locality Name (eg, city) [Default City]:PNQ
Organization Name (eg, company) [Default Company Ltd]:REDHAT
Organizational Unit Name (eg, section) []:QE
Common Name (eg, your name or your server's hostname) []:vm-idm-006.testrelm.test
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@vm-idm-006 ~]# ipa cert-request --principal=HTTP/`hostname` /tmp/cert-request-test/request1.csr 
  Subject: CN=vm-idm-006.testrelm.test,O=TESTRELM.TEST
  Issuer: CN=Certificate Authority,O=TESTRELM.TEST
  Not Before: Wed Nov 25 08:36:47 2015 UTC
  Not After: Sat Nov 25 08:36:47 2017 UTC
  Fingerprint (MD5): 8e:bd:6a:82:b5:7b:ba:85:a9:74:b7:83:48:24:48:ee
  Fingerprint (SHA1): ed:7b:4c:09:74:c9:6a:eb:91:b2:4b:52:bf:4b:7d:4c:ec:13:7a:07
  Serial number: 268369922
  Serial number (hex): 0xFFF0002
[root@vm-idm-006 ~]# 
[root@vm-idm-006 ~]# rpm -q ipa-server pki-ca
[root@vm-idm-006 ~]#
Comment 10 errata-xmlrpc 2015-12-08 05:37:44 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.