Description of problem:

create roles for Audit, Request and Approve.
Request role should not be able to approve.

No automatic issuance, the CA "Certificate Manager Agents" can approve certificates, and EE enrollment is authenticated

the following example provides an automatic issuance as expected, but I need authentication and authorization only to enroll in EE, no immediate issuance (an agent will approve in a second step).


Version-Release number of selected component (if applicable):
RHEL-7
RHCS-9

How reproducible:
yes


Steps to Reproduce:

1. install a CA

2. add a custom LDAP group called "requestors", for example

dn: cn=requestors,ou=groups,o=subca1-CA
description: requestors for Certificate Manager
objectClass: top
objectClass: groupOfUniqueNames
cn: requestors
uniqueMember: uid=requestor1,ou=people,o=subca1-CA

dn: uid=requestor1,ou=people,o=subca1-CA
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: cmsuser
uid: requestor1
sn: requestor1
cn: requestor1
mail: requestor1
usertype: userType
userstate: 1
userPassword: password


3. review default permissions

ldapsearch -o ldif-wrap=no -LLLxD cn=directory\ manager -w password -b o=subca1-CA cn=aclResources | grep "resourceACLS: certServer.ee."

resourceACLS: certServer.ee.request.ocsp:submit:allow (submit) ipaddress=".*":Any clients can submit ocsp requests
resourceACLS: certServer.ee.certificate:renew,revoke,read,import:allow (renew,revoke,read,import) user="anybody":Anybody may renew,import,revoke,read a certificate
resourceACLS: certServer.ee.certificates:revoke,list:allow (revoke,list) user="anybody":Anybody may revoke, list certificates
resourceACLS: certServer.ee.certchain:download,read:allow (download,read) user="anybody":Anybody may download a certificate chain
resourceACLS: certServer.ee.crl:read,add:allow (read,add) user="anybody":Anybody may add or retrieve CRL
resourceACLS: certServer.ee.request.enrollment:submit:allow (submit) user="anybody":Anybody may submit an enrollment request
resourceACLS: certServer.ee.requestStatus:read:allow (read) user="anybody":Anybody may read request status
resourceACLS: certServer.ee.request.revocation:submit:allow (submit) user="anybody":Anybody may submit a revocation request
resourceACLS: certServer.ee.profile:submit,read:allow (submit,read) user="anybody":Anybody may submit certificate profiles
resourceACLS: certServer.ee.profiles:list:allow (list) user="anybody":Anybody may list certificate profiles


4. try to customize some of those permissions:

- to restrict the end entity pages "profile list" to the LDAP requestors group:

dn: cn=aclResources,o=subca1-CA
changetype: modify
delete: resourceACLS
resourceACLS: certServer.ee.profiles:list:allow (list) user="anybody":Anybody may list certificate profiles
-
add: resourceACLS
resourceACLS: certServer.ee.profiles:list:allow (list) group="requestors":Requestors may list certificate profiles


- to restrict the end entity pages to access any specific profile, to the LDAP requestors group:

dn: cn=aclResources,o=subca1-CA
changetype: modify
delete: resourceACLS
resourceACLS: certServer.ee.profile:submit,read:allow (submit,read) user="anybody":Anybody may submit certificate profiles
-
add: resourceACLS
resourceACLS: certServer.ee.profile:submit,read:allow (submit,read) group="requestors":Requestors may submit certificate profiles


5- customize an enrollment profile to add LDAP authentication for the LDAP group requestors

/var/lib/pki/subca1/ca/profiles/ca/caUserCert.cfg
auth.instance_id=UserDirEnrollment
authz.acl=group="requestors" || group="Enterprise CA Administrators"


6. stop CA and add the LDAP authentication configuration

/etc/pki/subca1/ca/CS.cfg
auths.instance.UserDirEnrollment.dnpattern=uid=$attr.uid,ou=people,o=subca1-CA
auths.instance.UserDirEnrollment.ldap.basedn=ou=people,o=subca1-CA
auths.instance.UserDirEnrollment.ldap.ldapconn.host=ca1.example.test
auths.instance.UserDirEnrollment.ldap.ldapconn.port=389
auths.instance.UserDirEnrollment.ldap.ldapconn.secureConn=false
auths.instance.UserDirEnrollment.ldap.ldapconn.version=3
auths.instance.UserDirEnrollment.ldap.maxConns=
auths.instance.UserDirEnrollment.ldap.minConns=
auths.instance.UserDirEnrollment.ldapByteAttributes=
auths.instance.UserDirEnrollment.ldapStringAttributes=uid,cn,mail
auths.instance.UserDirEnrollment.pluginName=UidPwdDirAuth


7. start CA


Actual results:

automated issuance, but want agent approval

pki -d ~/.dogtag/subca1.client.dir/ca/alias/ -c password -U https://`hostname`:8443/ -n caadmin client-cert-request uid=guest1 --profile=caUserCert --algorithm rsa --length 2048 --type pkcs10 --username requestor1 --password
Password: 
-----------------------------
Submitted certificate request
-----------------------------
  Request ID: 23
  Type: enrollment
  Request Status: complete
  Operation Result: success
  Certificate ID: 0xe
[root@ca1 ~]# 


correct failed authorization, was not in requestors LDAP group:

pki -d ~/.dogtag/subca1.client.dir/ca/alias/ -c password -U https://`hostname`:8443/ -n caadmin client-cert-request uid=guest1 --profile=caUserCert --algorithm rsa --length 2048 --type pkcs10 --username guest1 --password
Password: 
UnauthorizedException: Authorization failed on resource: group="requestors" || group="Enterprise CA Administrators", operation: {1}
[root@ca1 ~]# 



Expected results:

No automatic issuance, the CA "Certificate Manager Agents" can approve certificates, and EE enrollment is authenticated

Additional info: