dogtagpki

#2128 REST API returns error code 400 when adding duplicate certificate profile
Closed: Invalid Opened by mbabinsk.

Closed: Invalid
Reopen Issue

ipa-server-upgrade uses Dogtag REST interface to add configured certificate profiles to the Dogtag backend. If the profile already exists, the rest API returns error code 400, which can cover a lot of scenarios (malformed request, missing elements etc.):

016-02-23T08:26:34Z DEBUG response status 400 Bad Request
2016-02-23T08:26:34Z DEBUG response headers {'transfer-encoding': 'chunked', 'date': 'Tue, 23 Feb 2016 08:26:34 GMT', 'connection': 'close', 'content-type': 'application/json', 'server': 'Apache-Coyote/1.1'}
2016-02-23T08:26:34Z DEBUG response body '{"Attributes":{"Attribute":[]},"ClassName":"com.netscape.certsrv.base.BadRequestException","Code":400,"Message":"Profile already exists"}'
2016-02-23T08:26:34Z DEBUG Error migrating 'caTokenUserDelegateAuthKeyEnrollment': Non-2xx response from CA REST API: 400 Bad Request. Profile already exists

It would be nice if the API returned more specific code like 409 so that clients have easier time handling duplicate entries during profile import.

Affected versions:

pki-base-10.2.5-6.el7.noarch
pki-base-10.2.6-14.fc23.noarch

Per CS/DS Triage Meeting of 03/22/2016: 10.3

I think this is already fixed.

I tested using both pki (java) and python clients on master.

python test:

from pki.client import PKIConnection
from pki.profile import ProfileClient
from pki.profile import Profile

connection = PKIConnection('https', 'localhost', '8443', 'ca')
connection.set_authentication_cert("/root/admin.pem")

client = ProfileClient(connection)

profile_data = client.get_profile('caInstallCACert')

try:
client.create_profile(profile_data)
except Exception as e:
print e
print e.code

returns:
Profile already exists
409

For java:

pki -v -d ~/.dogtag/pki-tomcat/alias/ -c redhat123 -n "PKI Administrator for laptop" ca-profile-add foo.profile

Returns as part of output:
HTTP response: HTTP/1.1 409 Conflict
Server: Apache-Coyote/1.1
Content-Type: application/xml
Content-Length: 232
Date: Mon, 02 May 2016 19:50:06 GMT
com.netscape.certsrv.base.ConflictingOperationException: Profile already exists
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)

Metadata Update from @mbabinsk:
- Issue assigned to vakwetu
- Issue set to the milestone: 10.3.1

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2334

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Normal
defect
Rest interface
Community
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.