Bug 696282 - Preinstall check needed if subject is not specified in required format
Summary: Preinstall check needed if subject is not specified in required format
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa
Version: 6.1
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: rc
: ---
Assignee: Rob Crittenden
QA Contact: Chandrasekar Kannan
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-04-13 18:37 UTC by Namita Soman
Modified: 2015-01-04 23:47 UTC (History)
4 users (show)

Fixed In Version: ipa-2.1.0-1.el6
Doc Type: Bug Fix
Doc Text:
Cause: If a user provides their own certificate subject base and the format is incorrect installation will fail. Consequence: The installation will fail in the CA step with a non-descriptive error. Fix: Validate that the subject base is in the correct format. Result: If an incorrect subject base is provided the user will be warned before installation begins.
Clone Of:
Environment:
Last Closed: 2011-12-06 18:21:40 UTC
Target Upstream Version:


Attachments (Terms of Use)
ipaserver-install.log (56.79 KB, application/octet-stream)
2011-04-13 18:41 UTC, Namita Soman
no flags Details


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:1533 normal SHIPPED_LIVE Moderate: ipa security and bug fix update 2011-12-06 01:23:31 UTC

Description Namita Soman 2011-04-13 18:37:52 UTC
Description of problem:
Install starts and fails when "configuring certificate server instance", when ipa server is installed as:
ipa-server-install --setup-dns --forwarder=10.14.63.12 --subject="NAMITA"  -r TESTRELM -p Secret123 -P Secret123 -a Secret123 -U

can install if correct subject and use it as 
ipa-server-install --setup-dns --forwarder=10.14.63.12 --subject="O=NAMITA"  -r TESTRELM -p Secret123 -P Secret123 -a Secret123 -U

So a preinstall check is needed here to make sure the format is correct before starting the install


Version-Release number of selected component (if applicable):
ipa-server-2.0.0-20.el6.x86_64

How reproducible:
always

Steps to Reproduce:
1.Install server with:
ipa-server-install --setup-dns --forwarder=10.14.63.12 --subject="O=NAMITA"  -r TESTRELM -p Secret123 -P Secret123 -a Secret123 -U


  
Actual results:
Install fails with error -
 [4/17]: configuring certificate server instance
root        : CRITICAL failed to configure ca instance Command '/usr/bin/perl /usr/bin/pkisilent ConfigureCA -cs_hostname rhel61-server5.testrelm -cs_port 9445 -client_certdb_dir /tmp/tmp-MhrvV4 -client_certdb_pwd 'XXXXXXXX' -preop_pin noaBWyOoDGqsRMaw6KQL -domain_name IPA -admin_user admin -admin_email root@localhost -admin_password 'XXXXXXXX' -agent_name ipa-ca-agent -agent_key_size 2048 -agent_key_type rsa -agent_cert_subject "CN=ipa-ca-agent,NAMITA" -ldap_host rhel61-server5.testrelm -ldap_port 7389 -bind_dn "cn=Directory Manager" -bind_password 'XXXXXXXX' -base_dn o=ipaca -db_name ipaca -key_size 2048 -key_type rsa -key_algorithm SHA256withRSA -save_p12 true -backup_pwd 'XXXXXXXX' -subsystem_name pki-cad -token_name internal -ca_subsystem_cert_subject_name "CN=CA Subsystem,NAMITA" -ca_ocsp_cert_subject_name "CN=OCSP Subsystem,NAMITA" -ca_server_cert_subject_name "CN=rhel61-server5.testrelm,NAMITA" -ca_audit_signing_cert_subject_name "CN=CA Audit,NAMITA" -ca_sign_cert_subject_name "CN=Certificate Authority,NAMITA" -external false -clone false' returned non-zero exit status 255
Unexpected error - see ipaserver-install.log for details:
 Configuration of CA failed


Expected results:
Install should not even start, and an error should be thrown before starting install - that the subject is not in acceptable format.


Additional info:

Comment 1 Namita Soman 2011-04-13 18:41:04 UTC
Created attachment 491850 [details]
ipaserver-install.log

Comment 3 Dmitri Pal 2011-04-14 00:31:06 UTC
https://fedorahosted.org/freeipa/ticket/1176

Comment 5 Rob Crittenden 2011-07-18 17:12:01 UTC
master: 038089a0c9160221d17796b8d6fd6e4f1fb67850

ipa-2-0: e6060eac6cb76b10b8cee896448bb3b28b7725de

Comment 7 Rob Crittenden 2011-10-31 17:51:14 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause: If a user provides their own certificate subject base and the format is incorrect installation will fail.
Consequence: The installation will fail in the CA step with a non-descriptive error.
Fix: Validate that the subject base is in the correct format.
Result: If an incorrect subject base is provided the user will be warned before installation begins.

Comment 8 Namita Soman 2011-11-04 17:19:52 UTC
verified using ipa-server-2.1.3-4.el6.x86_64

validation is done, and installation fails
# ipa-server-install --setup-dns --forwarder=10.14.63.12 --subject="NAMITA"  -r TESTRELM -p Secret123 -P Secret123 -a Secret123
Usage: ipa-server-install [options]

ipa-server-install: error: Invalid subject base format: malformed RDN string = "NAMITA"

Comment 9 errata-xmlrpc 2011-12-06 18:21:40 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2011-1533.html


Note You need to log in before you can comment on or make changes to this bug.