#6972 Replica installation grants HTTP principal access in WebUI
Closed: fixed Opened by pvoborni.

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1452216

Please note that this Bug is private and may not be accessible as it contains confidential Red Hat customer information.

Created attachment 1280051
gssproxy log from the replica installations
Description of problem:
When I install replica against an IPA server with external CA (does not
necessary have to be, didn't test normal CA/CA-less setups) and log in as a
common user, after uninstalling and installing the replica again, I become HTTP
principal when I refresh the page where I was previously logged.
Version-Release number of selected component (if applicable):
git master
How reproducible:
100%
Steps to Reproduce:
1. install IPA server
2. create a user with a password
3. log in as that user, set its password
4. install a replica against the IPA server, specifying --no-pkinit
5. log in as the created user to the Web UI using the password from step 3,
stay on the page
6. uninstall replica
7. install the replica, again specifying the --no-pkinit option
8. after the installation is complete, refresh the page in the browser from
step 5
9. you are now an HTTP principal in the Web UI
Actual results:
You become HTTP principal
Expected results:
You are either logged off or at least stay the same user.
Additional info:
The log contains information from the gssproxy daemon in debug mode with
debug_level set to 2.
In the reproducing steps, I am using
https://replica.example.com/ipa/ui/#/e/user/search as the page in the browser.

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1452216

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1452216

Metadata Update from @mbasti:
- Issue set to the milestone: FreeIPA 4.5.2

master:

  • 83619e804b53f2bfb8b0d94882c01abed23c4a9f Fix rare race condition with missing ccache file

ipa-4-5:

  • 90b432b93d71c795eaa4f92d3a9e1d322dce1802 Fix rare race condition with missing ccache file

Metadata Update from @mbasti:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata