RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 955699 - Host administrator privilege lacks certificate access
Summary: Host administrator privilege lacks certificate access
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.0
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: ---
Assignee: Rob Crittenden
QA Contact: Namita Soman
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-04-23 14:48 UTC by Dmitri Pal
Modified: 2014-06-18 00:09 UTC (History)
1 user (show)

Fixed In Version: ipa-3.2.1-1.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-06-13 13:23:32 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Dmitri Pal 2013-04-23 14:48:28 UTC 
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/3585

The host administrator privilege lacks the ability to manage certificates so a host with a certificate cannot be removed.

To test:
* Create a new user, tuser
* ipa role-add-member --user=tuser 'it specialist'
* ipa host-add test.example.com --force
* ipa host-del test.example.com (should work)
* ipa host-del <an enrolled client> (will fail)

I'm guessing that the minimum permissions required are 'revoke certificate' and 'Retrieve Certificates from the CA'
Comment 1 Rob Crittenden 2013-04-24 18:37:02 UTC 
Fixed upstream.

master: 4cff518517fb400a399fc3cb5cc8bf5285c7cbc5

ipa-3-1: 89f65ddccd8e08d30ddcedaf1f88fbb54066af0f
Comment 4 Namita Soman 2013-11-18 20:07:18 UTC 
Verified using ipa-server-3.3.3-4.el7.x86_64

Automated Test Results:
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: ipa-privilege-cli-1043: bz955699 - Host administrator privilege lacks certificate access
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

  Permissions: add hosts, remove hosts, modify hosts, manage host ssh public keys, manage host keytab, enroll a host, retrieve certificates from the ca, revoke certificate, add krbprincipalname to a host
:: [   PASS   ] :: Running 'ipa privilege-show "Host Administrators" | grep -i "revoke certificate"' (Expected 0, got 0)
  Permissions: add hosts, remove hosts, modify hosts, manage host ssh public keys, manage host keytab, enroll a host, retrieve certificates from the ca, revoke certificate, add krbprincipalname to a host
:: [   PASS   ] :: Running 'ipa privilege-show "Host Administrators" | grep -i "retrieve certificates from the ca"' (Expected 0, got 0)
'6f03da56-015e-4ed9-92a1-78355d8863a2'
ipa-privilege-cli-1043 result: PASS



::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: ipa-rbac-1023 - bz955699 -  Host administrator privilege lacks certificate access
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [ 16:25:20 ] ::  create ipa user: [testbz955699], firstname: [testbz955699], lastname: [testbz955699]  password: [Secret123]
:: [ 16:25:21 ] ::  create ipa user: [testbz955699], password: [Secret123]

<..snip..>


-------------------------
:: [ 16:25:32 ] ::  Added --users=testbz955699 to it specialist successfully

<..snip..>


:: [ 16:25:34 ] ::  Success: kinit as [testbz955699] with password [Secret123] was successful.
:: [   PASS   ] :: Running 'kinitAs testbz955699 Secret123' (Expected 0, got 0)
----------------------------------------
Deleted host "testbz955699.testrelm.com"
----------------------------------------
:: [   PASS   ] :: Running 'ipa host-del testbz955699.testrelm.com' (Expected 0, got 0)
------------------------------------------------
Deleted host "ibm-x3650m4-01-vm-08.testrelm.com"
------------------------------------------------
:: [   PASS   ] :: Delete an enrolled client. testbz955699 can do this only with the right permissions (Expected 0, got 0)
Comment 5 Ludek Smid 2014-06-13 13:23:32 UTC 
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.
Note You need to log in before you can comment on or make changes to this bug.