Bug 1832364

Description of problem:
User-signed CMC requests approval failed fail Invalid Credential Error


Version-Release number of selected component (if applicable):
rpm -qa | grep pki
pki-kra-10.5.18-3.el7.noarch
pki-server-10.5.18-3.el7.noarch
pki-ca-10.5.18-3.el7.noarch
pki-console-10.5.18-3.el7pki.noarch
redhat-pki-10.5.18-2.el7pki.noarch
jss-4.4.9-2.el7.x86_64
tomcatjss-7.2.5-1.el7.noarch



How reproducible:
Always

Test Setup:
> Discrete tomcat RSA-installation with ca, kra and ocsp installed on Non-HSM machine
> caFullCMCUserCert profile is enabled.
> local nssdb path : /opt/pki/certdb/

Steps to Reproduce:
1. Generate a  CRMF request using following command:

>>> CRMFPopClient -h internal -d /opt/pki/certdb -p SECret.123 -n 'CN=Testing,UID=shal2,O=Test Cert' -o /tmp/shal.csr -q POP_SUCCESS -w AES/CBC/PKCS5Padding

Keypair private key id: -72922c074070ec5e15ce002b29477d1bfc9eba5f
Storing CRMF request into /tmp/shal.csr
Storing CRMF request key id into /tmp/shal.csr.keyId


2. Copy generated key in cmc.cfg as follows:

>>>>cat shalcmc.cfg
format=crmf
numRequests=1
tokenname=internal
input=/tmp/shal.csr
output=/tmp/shalcmc_request.csr
password=SECret.123
nickname=PKI CA Administrator for Example.Org
dbdir=/opt/pki/certdb
request.privKeyId=-72922c074070ec5e15ce002b29477d1bfc9eba5f

3. Generate a CMCRequest using following command:
>>>> CMCRequest shalcmc.cfg 

cert/key prefix = 
path = /opt/pki/certdb
CryptoManger initialized
token internal logged in...
got signerCert: PKI CA Administrator for Example.Org
createPKIData: begins
k=0
createPKIData:  format: crmf
useSharedSecret is false...
signData: begins: 
getPrivateKey: got signing cert
signData:  got signer privKey
createSignedData: begins
getSigningAlgFromPrivate: begins.
getSigningAlgFromPrivate: found signingKeyType=RSA
getSigningAlgFromPrivate: using SignatureAlgorithm: RSASignatureWithSHA256Digest
createSignedData: digest created for pkidata
createSignedData: digest algorithm =RSASignatureWithSHA256Digest
createSignedData: building cert chain
signData: signed request generated.
getCMCBlob: begins
getCMCBlob: generating signed data

The CMC enrollment request in base-64 encoded format:

MIIMpAYJKoZIhvcNAQcCoIIMlTCCDJECAQMxDzANBglghkgBZQMEAgEFADCCArMG
.
. Output omited
.
26vmU9wjwp5i8IPd2viBqAv7stowjrh+

The CMC enrollment request in binary format is stored in /tmp/shalcmc_request.csr


4. Create a http.cfg file as follows:
>>>> cat shalhttp.cfg 
clientmode=true
secure=true
nickname=PKI CA Administrator for Example.Org
tokenname=internal
host=pki1.example.com
output=/tmp/shalcmc_response.crt
input=/tmp/shalcmc_request.csr
password=SECret.123
servlet=/ca/ee/ca/profileSubmitCMCFull?profileId=caFullCMCUserCert
port=20443
dbdir=/opt/pki/certdb


5. Send CMC request for approval using HttpClient using following command:
>>> HttpClient /tmp/shalhttp.cfg

Total number of bytes read = 3240
after SSLSocket created, thread token is Internal Key Storage Token
client cert is not null
handshake happened
writing to socket
Total number of bytes read = 1636
MIIGYAYJKoZIhvcNAQcCoIIGUTCCBk0CAQMxDzANBglghkgBZQMEAgMFADBJBggr
.
. Output omitted
.
+cJWeqf2madqdXFPS9vSOFfeZKgVcYjxcsAJTpMGIUc6oWfhlm6DHi69xyxO/izQ
thyu1g==

The response in binary format is stored in /tmp/shalcmc_response.crt

6. Validate the response using following command:

>>>>> CMCResponse -d /opt/pki/certdb/ -i /tmp/shalcmc_response.crt
Certificates: 
    Certificate: 
        Data: 
            Version:  v3
            Serial Number: 0x1
.
. output omitted
.


Number of controls is 1
Control #0: CMCStatusInfoV2
   OID: {1 3 6 1 5 5 7 7 25}
   BodyList: 0 
   Status String: Invalid Credential.
   OtherInfo type: FAIL
     failInfo=bad request
CMC Full Response.
ERROR: CMC status for [0]: failed


Actual results:
Output of CMCResponse shows: Invalid Credential
Debug logs on execution of step 5 shows below:

[06/May/2020:11:04:32][http-bio-20443-exec-7]: CMCOutputTemplate: getContentInfo:  - done
[06/May/2020:11:04:32][http-bio-20443-exec-7]: SignedAuditLogger: event CMC_RESPONSE_SENT
[06/May/2020:11:04:32][http-bio-20443-exec-7]: ProfileSubmitCMCServlet: authentication error Invalid Credential.
[06/May/2020:11:04:32][http-bio-20443-exec-7]: CMSServlet: curDate=Wed May 06 11:04:32 EDT 2020 id=caProfileSubmitCMCFull time=39
[06/May/2020:11:04:32][http-bio-20443-exec-7]: SignedAuditLogger: event ACCESS_SESSION_TERMINATED


Expected results:
Output of CMCResponse should show approved cert.


Additional info:
User-signed CMC requests approval is validated as per section 5.1 of following documentation, and it failed of pkcs10 request type with same error:
https://www.dogtagpki.org/wiki/PKI_10.4_CMC_Feature_Update_(RFC5272)#User-signed_CMC_requests_Example_.28with_PopLinkWitnessV2.29

Above steps is a regression steps and are run in pipelines for RHEL7.8 and worked fine that time.


Attached are all the files and CA debug logs for same.