Bug 492543 - agent authentication failing with signed CMC requests
agent authentication failing with signed CMC requests
Product: Dogtag Certificate System
Classification: Community
Component: Authentication (Show other bugs)
All Linux
high Severity medium
: ---
: ---
Assigned To: Christina Fu
Chandrasekar Kannan
Depends On:
Blocks: 443788
  Show dependency treegraph
Reported: 2009-03-27 07:42 EDT by David Stutzman
Modified: 2015-01-05 20:19 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-07-22 19:33:53 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
snippet of debug log from Dogtag (2.18 KB, text/plain)
2009-03-27 07:42 EDT, David Stutzman
no flags Details
snippet of debug log from RHCS7 for comparison (27.67 KB, text/plain)
2009-03-27 07:43 EDT, David Stutzman
no flags Details
just to make debug log messages more accurate (8.88 KB, patch)
2009-06-05 13:03 EDT, Christina Fu
no flags Details | Diff

  None (edit)
Description David Stutzman 2009-03-27 07:42:26 EDT
Created attachment 336993 [details]
snippet of debug log from Dogtag

Description of problem:
When I send an agent-signed CMC enrollment request to the CMC servlet, it fails with "ProfileSubmitServlet: authentication error Invalid Credential."

I'm fairly confident the CMC requests are OK as we are sending the same ones to Red Hat 7.1 CAs and they are working fine.  I am experiencing this error on freshly setup Dogtag CAs.  We can do SSL client auth to the Agent interface webpages with our browsers and the credential we supply works fine so we're pretty sure the agent cert piece is set up correctly as well.

I'm also fairly certain this used to work when I've tested in the past.  I looked through bugzilla for CMC bugs, found 4 (3 were mine), and it was fixed almost a year ago so I doubt that was it.

Version-Release number of selected component (if applicable):
     1  dogtag-pki-ca-ui-1.0.0-10.fc8
     2  dogtag-pki-common-ui-1.0.0-12.fc8
     3  dogtag-pki-console-ui-1.0.0-6.fc8
     4  osutil-1.0.0-6.fc8
     5  pki-ca-1.0.0-35.fc8
     6  pki-common-1.0.0-56.fc8
     7  pki-console-1.0.0-15.fc8
     8  pki-java-tools-1.0.0-8.fc8
     9  pki-native-tools-1.0.0-5.fc8
    10  pki-selinux-1.0.0-7.fc8
    11  pki-setup-1.0.0-20.fc8
    12  pki-util-1.0.0-12.fc8
    13  symkey-1.0.0-8.fc8

How reproducible:
I get the same behavior whether I send a DER encoded CMC request to the CMC servlet (/ca/ee/ca/profileSubmitCMCFull) or pasting a Base64 encoded request into the "Signed CMC-Authenticated User Certificate Enrollment" profile on the end entity web enrollment page.

Steps to Reproduce:
1. Create CMC request signed with credentials that are configured as agent on CA
2. send request to CA (using either DER/Base64 method above)
I've attached debug logs showing Dogtag vs RHCS7 which is the error vs success case.  The Dogtag process dies relatively early.  What I noticed is after they output "ProfileSubmitServlet: set sslClientCertProvider", RHCS makes an LDAP connection and comes back with my agent entry (I assume it took the cert from CMC's SignerInfo and searched in the directory for it) whereas Dogtag doesn't show the LDAP connection even being tried.
Comment 1 David Stutzman 2009-03-27 07:43:12 EDT
Created attachment 336994 [details]
snippet of debug log from RHCS7 for comparison
Comment 2 David Stutzman 2009-03-27 07:49:30 EDT
Forgot to mention, a co-worker tried sending raw CRMFs to the bulkissuance servlet and that was successful, but as that also uses SSL client auth that would be expected.
Comment 3 Christina Fu 2009-06-05 13:03:22 EDT
Created attachment 346685 [details]
just to make debug log messages more accurate
Comment 4 Christina Fu 2009-06-05 13:04:12 EDT
I just fixed https://bugzilla.redhat.com/show_bug.cgi?id=502861, and after that, CMC enrollment seems to be fine.  I do not see either Authentication or Authorization error.  This is working for both base 64 encoding from the caCMCUserCert profile at EE page, and for the CMC servlet (ca/ee/ca/profileSubmitCMCFull).

I am checking in changes to the log messages for profileSubmitCMCFull here since all log messages are saying "ProfileSubmitServlet" instead of "ProfileSubmitCMCServlet" and that's misleading and does not help with debugging.
Comment 5 Andrew Wnuk 2009-06-05 13:07:02 EDT
attachment (id=346685) +awnuk
Comment 6 Christina Fu 2009-06-05 13:11:27 EDT
[cfu@jaw common]$ pwd
[cfu@jaw common]$ svn commit src/com/netscape/cms/servlet/profile/ProfileSubmitCMCServlet.java
Sending        src/com/netscape/cms/servlet/profile/ProfileSubmitCMCServlet.java
Transmitting file data .
Committed revision 553.
Comment 7 David Stutzman 2009-06-05 14:14:50 EDT
I have tested and can confirm that I can both paste in Base64 CMC in webpage or hit the servlet with a DER request and I get a cert back.  However, I'm still being stuck with bug 441544 which causes the freshly issued cert to be expired immediately.

Comment 8 Kashyap Chamarthy 2009-06-21 06:14:39 EDT
Verified(with june-18-build). sending a CMC request using "Signed CMC-Authenticated User Certificate Enrolment" in the EE pages succeeds.

Note You need to log in before you can comment on or make changes to this bug.