freeipa

#7304 double ca acl provoke console error.
Closed: fixed Opened by frenaud.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1517886

Description of problem:
(logging this bug with low priority just for documentation of a customer issue)
There's a console "Operations Error" when accessing this in the console:
Authentication -> Certificates -> CA ACLs
When clicking on CA ACLs a dialog box pops up and states:
Operations Error
Version-Release number of selected component (if applicable):
   ipa-server-4.4.0-14.el7_3.7.x86_64
the httpd logs are showing:
==========
[Wed Nov 22 17:07:59.459223 2017] [:error] [pid 2565] ipa: INFO:
user@REALM.COM: batch: caacl_show(u'hosts_services_caIPAserviceCert',
no_members=True): SingleMatchExpected
==========
Then we search the ldap database and we find these objects:
dn: ipaUniqueID=f9f4a83a-ad67-11e5-a500-12958cd037e3,cn=caacls,cn=ca,dc=example
,dc=com
ipaMemberCertProfile:
cn=caIPAserviceCert,cn=certprofiles,cn=ca,dc=example,dc=com
serviceCategory: all
cn: hosts_services_caIPAserviceCert
objectClass: ipaassociation
objectClass: ipacaacl
hostCategory: all
ipaEnabledFlag: TRUE
ipaUniqueID: f9f4a83a-ad67-11e5-a500-12958cd037e3
dn: ipaUniqueID=f89ac5cc-ad68-11e5-aa96-001a4aa86515,cn=caacls,cn=ca,dc=example
,dc=com
ipaMemberCertProfile: cn=caIPAserviceCert,cn=certprofiles,cn=ca,dc=example,
dc=com
serviceCategory: all
cn: hosts_services_caIPAserviceCert
objectClass: ipaassociation
objectClass: ipacaacl
hostCategory: all
ipaEnabledFlag: TRUE
ipaUniqueID: f89ac5cc-ad68-11e5-aa96-001a4aa86515
So, once one deleted, the console is working fine. But we don't know how it has
been generated.
A "ipa caacl-add" will check the cn attribute not to allow to have duplicates.
But as the rdn of the distinguished name is ipaUniqueID instead of cn (why ?),
a duplicated could be added into the database without any issue.
the cn attribute uniqness is only enforced in ipa under:
uniqueness-attribute-name: cn
uniqueness-subtrees: cn=ng,cn=alt,dc=example,dc=com
uniqueness-attribute-name: cn
uniqueness-subtrees: cn=sudorules,cn=sudo,dc=example,dc=com
I consider this a bug since the console does not know how to cope when finding
more than one caacls with same profile.

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1517886

Metadata Update from @frenaud:
- Issue priority set to: low

Yes, we should activate the uniqness enforcement on cn.

Trying to remember why ipauniqueid was used for RDN... but I cannot recall.
I think it might have been based on a wrong assumption that cn in RDN would
make it harder to rename the rule.

Metadata Update from @ftweedal:
- Issue assigned to ftweedal

Metadata Update from @ftweedal:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/1365

master:

  • 0e9ce73a52c953f7e798150c6e720c41594a99b0 Add uniqueness constraint on CA ACL name

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @pvoborni:
- Issue set to the milestone: FreeIPA 4.7 (was: FreeIPA 4.8)

ipa-4-6:

  • 2b442126cb7a47631cd6eb745790d2df944b2395 Add uniqueness constraint on CA ACL name
Metadata
None
None
None
High
https://github.com/freeipa/freeipa/pull/1365
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.