https://review.gerrithub.io/c/dogtagpki/pki/+/416056

---

commit 2d40c57887f7801f2ab0a8065b3b471bb7eafe80 (HEAD -> DOGTAG_10_5_BRANCH, origin/DOGTAG_10_5_BRANCH, gerrit/DOGTAG_10_5_BRANCH)
Author: Christina Fu <cfu>
Date:   Tue Jun 19 15:21:54 2018 -0700

    Ticket 3037 CMC SharedToken SubjectDN default
    
    This patch adds proper subjectDN to CMC requests authenticated via ShardToken.
    Specifically, the AuthTokenSubjectNameDefault profile default is added to
    the default CMC profiles that authenticates via SharedToken.
    Code were added to ensure that the proper subjectDN retrieved from the
    mapped user entry is added to the AuthToken for such utilization.
    
    Fixes https://pagure.io/dogtagpki/issue/3037
    
    Change-Id: Id92d9496ab5b41ea7b5dcffb8d73d3ffe8b29fbc

Test procedure:

Set up and follow CMC Shared Token enrollment such as this:
http://www.dogtagpki.org/wiki/PKI_10.5_CMC_Shared_Token#Example_Enrollment_Procedure

Make sure when you generate the CSR, use a subjectDN that's different from the ldap user (identification)'s DN.
When specifying profileid in the servlet entry of HttpClient config file, use
   - caFullCMCSelfSignedCert.cfg for RSA
   - caECFullCMCSelfSignedCert.cfg for ECC

Once certificate is issued successfully, check that the resulting certificate contains the subjectDN that matches with the user's ldap record, and not the one specified in the CSR.

---
For negative cases:

Try using a different profile.
e.g. generate the self signed csr, etc etc...
but in Httpclient, use
servlet=/ca/ee/ca/profileSubmitUserSignedCMCFull?profileId=caECFullCMCUserSignedCert

doc text looks good. thanks.

Hi Christina,

I have used different ldap user DN and csr subject DN.

1. Ldap user : dn: cn=user34a,ou=Groups,dc=example,dc=org
2. csr subject dn : uid=testuser-88,cn=selfsign

Actual Result: Certificate generated has subject dn == Subject: UID=testuser-88,CN=selfsign
=============

But I think expected is to have certificate generated with subject dn == ldap user dn

Below is the test procedure

Ldap entry looks like:
======================

I am searching in Groups instead of People .I have done changes in CS.cfg for that.

dn: cn=user34a,ou=Groups,dc=example,dc=org
objectClass: extensibleobject
objectClass: top
objectClass: inetorgperson
objectClass: organizationalPerson
objectClass: person
cn: user1a
sn: user1a
givenName: user1a
mail: user1a
uid: user3a
firstname: user1a
shrtoktesting: MIGVBIGAQXuw45hWJGf7rTD2ytNN+qYwEpPR6nfC197q1f2P0bStnLxLFFkFslXGlumRQgYIEvfLJZzK9Co+P3Gx7mu+IqdozC7UYsNeSkQDiOWFG6CKOGr7j7EwzHtT6WdXz2nwiT6SSbeQN/iPHF7zDfJ0L3Gs/4v9mhpd7gXLM/IQcZAEEP4BlHIW840mh+4MqKlSuVI=


Test Case 1: 
============

1. Generate csr.

PKCS10Client -d test/ -p SECret.123 -n "uid=testuser-88,cn=selfsign"  -a ec -y true -c nistp384 -o crmf2.req

2. Run CMCRequest with selfsign=true
3. Run HttpClient and use servlet=/ca/ee/ca/profileSubmitCMCFull?profileId=caECFullCMCSelfSignedCert

4. Check the CMCResponse for certificate header and subjectDN.

Certificates: 
    Certificate: 
        Data: 
            Version:  v3
            Serial Number: 0x5F
            Signature Algorithm: SHA384withEC - 1.2.840.10045.4.3.3
            Issuer: CN=Company Root CA2,O=Company,C=US
            Validity: 
                Not Before: Tuesday, July 31, 2018 9:50:44 AM EDT America/New_York
                Not  After: Sunday, January 27, 2019 9:50:44 AM EST America/New_York
            Subject: UID=testuser-88,CN=selfsign






From debug logs :

cmcRequestCertSubject=UID=testuser-88,CN=selfsign

SharedSecret.getSharedToken(String identification, IAuthToken authToken): searching for identification =user3a; mShrTokAttr =shrTokTesting
SharedSecret.getSharedToken(String identification, IAuthToken authToken): found user ldap entry: userdn = cn=user34a,ou=Groups,dc=example,dc=org
31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.profileapprovedby$ value=caadmin
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.auth_token.cmcselfsigned$ value=true
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.authenticatedname$ value=cn=user34a,ou=Groups,dc=example,dc=org
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.cert_request$ value=oIIBXwIBATCCAVgwgd8CAQAwMDERMA8GA1UEAwwIc2VsZnNpZ24xGzAZBgoJkiaJ
k/IsZAEBDAt0ZXN0dXNlci04ODB2MBAGByqGSM49AgEGBSuBBAAiA2IABE8tYIWZ
k8BYyYbfMKy2LUTflt1tUc/rrrG1sARLjJtkQQush3kD50sHASzaDspz4qI2MS4Y
9lXP6qWORx8cMGeo6FTv1v5qZoxVdn2ypS1sjZ/GNnnl8VoyAsx+VSS9+6AwMC4G
CSqGSIb3DQEJDjEhMB8wHQYDVR0OBBYEFGvSzRY+f+WqyDGTdtC6ejzCIxnfMAoG
CCqGSM49BAMCA2gAMGUCMAemNerWfKqrbP6LLr92JbFcZSxtGijw1inEtuvJ+V0e
WiZ/Ss3OaMCi+pfdbZDKsAIxANQhJestzt0wYl5w2Jvt0g6n3KopD8HcsGlBXAHD
twQ9oRXUS/VnYxa87PhXAlf0vA==

[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.profile$ value=true
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.requestversion$ value=1.0.0
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.req_subject_name.cn$ value=selfsign
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.req_locale$ value=en
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.dbstatus$ value=NOT_UPDATED
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.requeststatus$ value=begin
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.req_key$ value=MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAETy1ghZmTwFjJht8wrLYtRN+W3W1Rz+uu
sbWwBEuMm2RBC6yHeQPnSwcBLNoOynPiojYxLhj2Vc/qpY5HHxwwZ6joVO/W/mpm
jFV2fbKlLWyNn8Y2eeXxWjICzH5VJL37

[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.auth_token.authmgrinstname$ value=CMCUserSignedAuth
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.auth_token.uid$ value=$Unidentified$
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.auth_token.userid$ value=$Unidentified$
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.auth_token.cert_request_type$ value=cmc-pkcs10
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.profileid$ value=caECFullCMCSelfSignedCert
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.requestid$ value=136
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.auth_token.tokencertsubject$ value=cn=user34a,ou=Groups,dc=example,dc=org
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.auth_token.authtime$ value=1533045044159
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.req_x509info$ value=MIIBxKADAgECAgEAMAoGCCqGSM49BAMDMDoxCzAJBgNVBAYTAlVTMRAwDgYDVQQK
EwdDb21wYW55MRkwFwYDVQQDExBDb21wYW55IFJvb3QgQ0EyMB4XDTE4MDczMTEz
NTA0NFoXDTE5MDEyNzE0NTA0NFowMDERMA8GA1UEAwwIc2VsZnNpZ24xGzAZBgoJ
kiaJk/IsZAEBDAt0ZXN0dXNlci04ODB2MBAGByqGSM49AgEGBSuBBAAiA2IABE8t
YIWZk8BYyYbfMKy2LUTflt1tUc/rrrG1sARLjJtkQQush3kD50sHASzaDspz4qI2
MS4Y9lXP6qWORx8cMGeo6FTv1v5qZoxVdn2ypS1sjZ/GNnnl8VoyAsx+VSS9+6OB
pzCBpDAfBgNVHSMEGDAWgBR0EMvPl3p8ZpXkr5IQNPAlB1ayFjBSBggrBgEFBQcB
AQRGMEQwQgYIKwYBBQUHMAGGNmh0dHA6Ly9ub2NwNC5pZG0ubGFiLmVuZy5yZHUy
LnJlZGhhdC5jb206MjgwODAvY2Evb2NzcDAOBgNVHQ8BAf8EBAMCA9gwHQYDVR0l
BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME

[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.req_seq_num$ value=0
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.profilesetid$ value=cmcUserCertSet
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.req_subject_name.uid$ value=testuser-88
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.profileremoteaddr$ value=10.8.60.16
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.requesttype$ value=enrollment
[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.req_extensions$ value=oyEwHzAdBgNVHQ4EFgQUa9LNFj5/5arIMZN20Lp6PMIjGd8=

[31/Jul/2018:09:50:44][http-bio-28443-exec-1]: ProfileSubmitCMCServlet: key=$request.req_subject_name$ value=MDAxETAPBgNVBAMMCHNlbGZzaWduMRswGQYKCZImiZPyLGQBAQwLdGVzdHVzZXIt
ODg=

Are you using a fresh installation with the updated profiles?
Please show me the content of caECFullCMCSelfSignedCert.cfg

Also, as a FYI, the fix (now in review) for https://bugzilla.redhat.com/show_bug.cgi?id=1601071 is on its way.
That means whatever tests you performed with this current bug in this area will need to be tested again later as code will be superseded by the new fix.

We can still continue the investigation on this though.  thanks.

I tried picking the new selfsigned profile and it worked.
It picks up the subject dn correctly. certificate has below mentioned inputs:

I have used different ldap user DN and csr subject DN.

Test case 1 :  Test case with profile caECFullCMCSelfSignedCert
1. Ldap user : dn: cn=user34a,ou=Groups,dc=example,dc=org
2. csr subject dn : uid=testuser-88,cn=selfsign

Output Certificate :

Certificates: 
    Certificate: 
        Data: 
            Version:  v3
            Serial Number: 0x67
            Signature Algorithm: SHA384withEC - 1.2.840.10045.4.3.3
            Issuer: CN=Company Root CA2,O=Company,C=US
            Validity: 
                Not Before: Thursday, August 2, 2018 5:03:54 AM EDT America/New_York
                Not  After: Tuesday, January 29, 2019 5:03:54 AM EST America/New_York
            Subject: CN=user34a,OU=Groups,DC=example,DC=org
            Subject Public Key Info: 
                Algorithm: EC - 1.2.840.10045.2.1
                Public Key: 



Test Case 2 : Test case with profile caFullCMCSelfSignedCert

1. Ldap user : dn: cn=user34a,ou=Groups,dc=example,dc=org
2. csr subject dn : uid=testuser-88,cn=selfsign

Output Certificate :

    Certificate: 
        Data: 
            Version:  v3
            Serial Number: 0x68
            Signature Algorithm: SHA384withEC - 1.2.840.10045.4.3.3
            Issuer: CN=Company Root CA2,O=Company,C=US
            Validity: 
                Not Before: Thursday, August 2, 2018 5:13:59 AM EDT America/New_York
                Not  After: Tuesday, January 29, 2019 5:13:59 AM EST America/New_York
            Subject: CN=user34a,OU=Groups,DC=example,DC=org
            Subject Public Key Info: 
                Algorithm: RSA - 1.2.840.113549.1.1.1
                Public Key: 
                    Exponent: 65537

Marking this bug verified. 
I'll re-test this test case again while testing fix  https://bugzilla.redhat.com/show_bug.cgi?id=1601071.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:2306