dogtagpki

#2889 Unable to have non "pkiuser" owned CA instance
Closed: fixed Opened by mharmsen.

Closed: fixed
Reopen Issue

It appears that it is no longer possible to utilize a customized "pkiuser" account (e. g. - "pkiuser-ca" rather than just "pkiuser")

Metadata Update from @mharmsen:
- Custom field component adjusted to None
- Custom field feature adjusted to None
- Custom field origin adjusted to None
- Custom field proposedmilestone adjusted to None
- Custom field proposedpriority adjusted to None
- Custom field reviewer adjusted to None
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1523250
- Custom field type adjusted to None
- Custom field version adjusted to None

Metadata Update from @mharmsen:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1523410 (was: https://bugzilla.redhat.com/show_bug.cgi?id=1523250)

Metadata Update from @mharmsen:
- Issue assigned to mharmsen

Metadata Update from @mharmsen:
- Issue assigned to vakwetu (was: mharmsen)

commit d1435e2b474dd1bab1e958611a9e4d1bdf1d90ef (HEAD -> master, origin/master, origin/HEAD)
Author: Ade Lee alee@redhat.com
Date: Wed Jan 17 18:31:19 2018 -0500

Allow instances to be created with custom users
Some folks want to run instances under a different user and
group (ie. not pkiuser).  They may even want a different user for
each instance.  The way to do this in systemd is to create systemd
override files for the specific instance.
The deployment scriptlets have been updated to create (and delete)
these override files.
Change-Id: Icb0b6d15c6c8542dbbd565987d5fb3f1bddf6037

Metadata Update from @vakwetu:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

10.5 branch:

commit afe0a2525cace41a1bef2ff7fe0f8f53aa5990e5 (HEAD -> DOGTAG_10_5_BRANCH, origin/DOGTAG_10_5_BRANCH, port_user_fixes)
Author: Ade Lee alee@redhat.com
Date: Wed Jan 17 18:31:19 2018 -0500

Allow instances to be created with custom users
Some folks want to run instances under a different user and
group (ie. not pkiuser).  They may even want a different user for
each instance.  The way to do this in systemd is to create systemd
override files for the specific instance.
The deployment scriptlets have been updated to create (and delete)
these override files.
Change-Id: Icb0b6d15c6c8542dbbd565987d5fb3f1bddf6037

also:

10.5 branch:

commit 96e99209b278b5ba380a61486a5b6ce6a87326a0
Author: Ade Lee alee@redhat.com
Date: Tue Jan 16 15:10:15 2018 -0500

Make sure tomcat is running as pki user with nuxwdog
The nuxwdog process needs to run as a privileged user to be able
to retrieve the passwords from the systemd tty agent in systemctl.
Therefore, the nuxwdog unit file should NOT specify the PKI user
there.
However, we have added an option to nuxwdog to specify the user
in the nuxwdog config file, so that the process that nuxwdog spawns
(ie. tomcat) will run as the specified user.
The code changes in this patch ensure that when the nuxwdog conf
file is created, the user is set correctly as the value of the
variable TOMCAT_USER.
Change-Id: I0b4f8caedb048aaedf6a8a8f72b24fab39ad7bbf

master:

commit ce8872cfc92c7e11afe3ec551159835805725d34
Author: Ade Lee alee@redhat.com
Date: Tue Jan 16 15:10:15 2018 -0500

Make sure tomcat is running as pki user with nuxwdog
The nuxwdog process needs to run as a privileged user to be able
to retrieve the passwords from the systemd tty agent in systemctl.
Therefore, the nuxwdog unit file should NOT specify the PKI user
there.
However, we have added an option to nuxwdog to specify the user
in the nuxwdog config file, so that the process that nuxwdog spawns
(ie. tomcat) will run as the specified user.
The code changes in this patch ensure that when the nuxwdog conf
file is created, the user is set correctly as the value of the
variable TOMCAT_USER.
Change-Id: I0b4f8caedb048aaedf6a8a8f72b24fab39ad7bbf

Metadata Update from @mharmsen:
- Issue set to the milestone: 10.5.4 (was: 10.5)

Metadata Update from @mharmsen:
- Custom field fixedinversion adjusted to pki-core-10.5.4-1.fc27

Re-opened due to another issue

Metadata Update from @mharmsen:
- Issue set to the milestone: 10.5 (was: 10.5.4)
- Issue status updated to: Open (was: Closed)

New commits to solve issues, specifically
- code added that was python 3 specific.
- making top level registry directories owned by package and world readable and executable (755).

master:

commit 79e8a8e99a3c9c6d16b63bb5d4b2b18a4b828b11
Author: Ade Lee alee@redhat.com
Date: Thu Feb 1 13:02:03 2018 -0500

More fixes for non-standard users
Needed to fix some python code that was added that works only on Python 3.
The top level directories for the registry should be owned by
root and be world readable/executable so that different users
can read the registry.
Change-Id: Ic0ce188cb678ff66e1a7370451f8df2285fc1282

commit dcc66d504437bd0f1f22a2a880f8f2cff90a964a (gerrit/master)
Author: Ade Lee alee@redhat.com
Date: Thu Feb 1 14:50:05 2018 -0500

Spec file changes to add registry directories to package
Change-Id: Ib1c3761e33ed4adf107e0288e0fe8452d6071076

7.5:

commit 60cfdd1a0c1ecd418cab8d3f8a28f1b89e727514 (add_nonstancdard_user_changes)
Author: Ade Lee alee@redhat.com
Date: Thu Feb 1 14:50:05 2018 -0500

Spec file changes to add registry directories to package
Change-Id: Ib1c3761e33ed4adf107e0288e0fe8452d6071076
cherry-pick form dcc66d504437bd0f1f22a2a880f8f2cff90a964a

commit e37ddfbc8b54e17dbe081221f6c849732a30ebe2
Author: Ade Lee alee@redhat.com
Date: Thu Feb 1 13:02:03 2018 -0500

More fixes for non-standard users
Needed to fix some python code that was added that works only on Python 3.
The top level directories for the registry should be owned by
root and be world readable/executable so that different users
can read the registry.
Change-Id: Ic0ce188cb678ff66e1a7370451f8df2285fc1282
cherry-pick from 79e8a8e99a3c9c6d16b63bb5d4b2b18a4b828b11

Metadata Update from @vakwetu:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @mharmsen:
- Issue set to the milestone: 10.5.5 (was: 10.5)

Metadata Update from @mharmsen:
- Custom field fixedinversion adjusted to pki-core-10.5.5-1.fc27 (was: pki-core-10.5.4-1.fc27)

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/3007

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Low
None
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.