freeipa

#9626 ipa-replica/server-install with softhsm needs to check permission/ownership of /var/lib/softhsm/tokens to avoid install failure.
Closed: fixed by rcritten. Opened by sumenon.

Closed: fixed
Reopen Issue

Issue

ipa-replica-install with softhsm should check permission/ownership of /var/lib/softhsm/tokens to avoid install failure.

Steps to Reproduce

  1. Install IPA server
  2. Copy the token from IPA server to Replica
  3. Install replica using the token.

Actual behavior

Currently we are adding pkiuser to group ods, if that is missing on replica/server the installation would fail.
strace show the below error
/var/lib/softhsm/tokens", 0x7fff117d7a00, 0) = -1 EACCES (Permission denied), which is caused due to pkiuser not being member of ods group.

org.mozilla.jss.NoSuchTokenException: No such token: ipa_token
at org.mozilla.jss.CryptoManager.getTokenByName(CryptoManager.java:198)
at com.netscape.cmsutil.crypto.CryptoUtil.getKeyStorageToken(CryptoUtil.java:404)
at com.netscape.cmstools.cli.MainCLI.init(MainCLI.java:549)
at com.netscape.cmstools.nss.NSSCertImportCLI.execute(NSSCertImportCLI.java:69)
at org.dogtagpki.cli.CommandCLI.execute(CommandCLI.java:58)
at org.dogtagpki.cli.CLI.execute(CLI.java:353)
at org.dogtagpki.cli.CLI.execute(CLI.java:353)
at org.dogtagpki.cli.CLI.execute(CLI.java:353)
at com.netscape.cmstools.cli.MainCLI.execute(MainCLI.java:659)
at com.netscape.cmstools.cli.MainCLI.main(MainCLI.java:698)
DEBUG: NSSDatabase.import_cert_chain(caSigningCert External CA) ends

Expected behavior

Try to check permission to avoid this issue.

Version/Release/Distribution

freeipa-server-4.12.1-1.fc41.x86_64
389-ds-base-3.1.0-10.fc41.x86_64
dogtag-pki-ca-11.5.0-3.fc41.1.noarch
krb5-server-1.21.2-5.fc40.x86_64
softhsm-2.6.1-9.fc40.x86_64

Metadata Update from @rcritten:
- Issue assigned to rcritten

PR https://github.com/freeipa/freeipa/pull/7435

master:

  • 202de166c6057cdfd9bd024069c8e9e6a87c34d0 Run HSM validation as pkiuser to verify token permissions

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-52222, https://issues.redhat.com/browse/RHEL-52223

ipa-4-12:

  • 38b83c2b9329b8b16096d63e83f186c91d578ce8 Run HSM validation as pkiuser to verify token permissions

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 58c1fdd41681c15f39b59bbb5e39b2e1cf245c6c ipatests: Replace 'usermod -r' command with 'gpasswd -d' in test_hsm.py

ipa-4-12:

  • ed813fe6f0716906c8b9cd09c27e3acfb8b21e43 ipatests: Replace 'usermod -r' command with 'gpasswd -d' in test_hsm.py
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.