Bug 1845447

*** Bug 1845409 has been marked as a duplicate of this bug. ***

I could not find the string "secretRequired" anywhere in Dogtag or any XML configuration file. I *think* it's coming from the implicit default in the abstract AJP protocol class:

apache-tomcat-9.0.30.redhat-4-src/java/org/apache/coyote/ajp/AbstractAjpProtocol.java:    private boolean secretRequired = true;

The bug may be a regression in pki-servlet-engine.

PS: /etc/pki/pki-tomcat/server.xml does not set a secret.

Hey Christian,

My understanding was that IPA was supposed to take care of setting the secret for AJP-based installations. Perhaps this logic needs to be modified to install without AJP and then add the AJP connector afterwards -- including the secret?

I thought y'all had tested this in PR-CI... Perhaps we should switch the component to pki-servlet-engine and then needinfo Coty for any behavior changes between Fedora and RHEL? The difference in specs seems reasonable, other than that Fedora came from the upstream build and PKI came from JBoss's internal build tree. I can't seem to find that line in the upstream sources for 9.0.30...

Hey Coty -- is the line Christian identified above (and resulting failure) something JWS-specific? Thanks!

Alex,

we do set up requireSecret but only after basic pkispawn completes. Before that there is no configuration file at all. So pkispawn fails because, it seems, the setting was enforced in tomcat as a default. This means pkispawn should generate own secret explicitly.

Yes, we are going to take care afterwards. But first pkispawn must succeed. IPA cannot update the setting when Dogtag fails to install (sorry for pointing out the obvious) .

(In reply to Alexander Bokovoy from comment #6)
> Alex,
> 
> we do set up requireSecret but only after basic pkispawn completes. Before
> that there is no configuration file at all. So pkispawn fails because, it
> seems, the setting was enforced in tomcat as a default. This means pkispawn
> should generate own secret explicitly.

Sorry Alexander, let me clarify:

I know you don't generate secret during pkispawn.

I know you don't specify AJP parameters during installation, but modify it afterwards.


My suggestion was:

 - To your configuration overrides passed to pkispawn (CA.cfg or whatever), add the line:
       pki_enable_proxy = false
   this will comment-out the AJP connector during installation:
       https://github.com/dogtagpki/pki/blob/master/base/server/tomcat-8.5/conf/server.xml#L191-L197
   (the rest of the values will be propagated as they currently are):
       https://github.com/dogtagpki/pki/blob/master/base/server/python/pki/server/deployment/pkiparser.py#L754-L777
 - Run pkispawn
 - When there is no AJP connector, first look for a commented-out one:
   https://github.com/freeipa/freeipa/blob/master/ipaserver/install/dogtaginstance.py#L310-L313
 - Then set secret and restart CA.


My 2c, but this would ensure we always get a secured AJP connector and don't have to deal with a temporarily-insecure AJP connector. 

We could confirm with Endi that this approach would work if you want to take it.

(In reply to Alex Scheel from comment #5)
> Hey Coty -- is the line Christian identified above (and resulting failure)
> something JWS-specific? Thanks!

Hi Alex, I guess you could say that this functionality is JWS specific, but only because it's the result of me not modifying the behaviour of Tomcat like I did for Fedora and RHEL distros (or JWS 3.1, maintenance stream). We didn't want to introduce a change to defaults in a zstream or maintenance phase of any product so a patch was introduced to reset the default to it's previous value (false), to reset the default bind address from lo to 0.0.0.0, and a couple other things I can't recall at the moment. This was done in the Fedora package (except rawhide, it uses the new defaults and disables AJP by default) and RHEL 6 & 7 so that things would not break after updates. JWS 5.3 however did not revert the upstream defaults and therefore breaks the AJP connector if users don't modify their configurations accordingly.

For a fix, I would say that we can easily modify the default server.xml in the pki-servlet-engine package because you're the only ones using it :) However, JWS 5.3 doesn't have the AJP connector enabled by default (therefore neither does the pki-servlet-engine package), so it's being configured somewhere in your installation it seems. I think that's the place that needs updating, not the pki-servlet-engine package itself.

\o Hey Kaleem,

Workaround for the time being until we get this fixed in isnap3:

Modify /usr/share/pki/server/conf/server.xml:

It should have contents like:

    <!-- Define an AJP 1.3 Connector on port [PKI_AJP_PORT] -->
[PKI_OPEN_AJP_PORT_COMMENT]
    <Connector port="[PKI_AJP_PORT]"
               protocol="AJP/1.3"
               redirectPort="[PKI_AJP_REDIRECT_PORT]"
               address="[PKI_AJP_HOST]" />
[PKI_CLOSE_AJP_PORT_COMMENT]


I _believe_ it should be sufficient to add an attribute for requiredSecret or secret here (depending on tomcat version used -- 9.0.30 or older for requiredSecret, 9.0.31+ for secret):

    <!-- Define an AJP 1.3 Connector on port [PKI_AJP_PORT] -->
[PKI_OPEN_AJP_PORT_COMMENT]
    <Connector port="[PKI_AJP_PORT]"
               protocol="AJP/1.3"
               redirectPort="[PKI_AJP_REDIRECT_PORT]"
               address="[PKI_AJP_HOST]" 
               requiredSecret="Secret.123" />
[PKI_CLOSE_AJP_PORT_COMMENT]


Untested, but this _should_ allow ipa-server-install to pick up this testing secret ("Secret.123") and put it in httpd config and let pkispawn succeed by providing a dummy secret.


HTH,

- Alex

Checked-in upstream:

commit e2ee6e1e6a08cb128a7ce04f04961325eff96c0d
Author: Alexander Scheel <ascheel>
Date:   Tue Jun 9 13:51:21 2020 -0400

    Make pki_ajp_secret a random password by default
    
    Signed-off-by: Alexander Scheel <ascheel>

commit 1bd84062c95797572de2464c095f5ab4f55e03c7
Author: Alexander Scheel <ascheel>
Date:   Tue Jun 9 18:21:13 2020 -0400

    Add migration logic for 8.5 -> 9.0.31
    
    Signed-off-by: Alexander Scheel <ascheel>

commit 76820004f231bcc4291cb63699a89746bd78c8e7
Author: Alexander Scheel <ascheel>
Date:   Tue Jun 9 12:21:24 2020 -0400

    Introduce pki_ajp_secret configuration parameter
    
    Signed-off-by: Alexander Scheel <ascheel>


This was present in Fedora -a2 builds.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:4847