freeipa

#7506 cert-request fails with "ipalib.errors.ACIError: Insufficient access: Principal 'alice@IPA.TEST' is not permitted to use CA 'ipa' with profile 'smime' for certificate issuance."
Closed: duplicate Opened by fbarreto.

Closed: duplicate
Reopen Issue

Issue

IPA's xmlrpc tests are failing when running with Dogtag master branch. They fail in api.Command.cert_request(csr, principal=smime_user...) with the message "ipalib.errors.ACIError: Insufficient access: Principal 'alice@IPA.TEST' is not permitted to use CA 'ipa' with profile 'smime' for certificate issuance."

Full log attached.

Steps to Reproduce

  1. Run xmlrpc tests with Dogtag master branch

IPA Version

I'm running against the latest IPA available in updates - 4.6

freeipa-integration.txt

Metadata Update from @ftweedal:
- Issue assigned to ftweedal

@fbarreto I cannot reproduce. The failures are all in IPA - Dogtag isn't involved.

There was recently a permission/ACI issue that caused CA ACLs to be unreadable.
That is likely the cause: https://pagure.io/freeipa/issue/7466

There is a commit in master to work around it
(34d06b2be71823bc8898732f1ced0185f83afb01 / PR https://github.com/freeipa/freeipa/pull/1752).
Does your installation have this commit?

@ftweedal, dmoluguw is the reporter of the issue. I asked more details to him and as soon as I have them I'll put on this ticket.

@ftweedal The following packages are being installed:

Installing: 
freeipa-server x86_64 4.6.90.pre1-6.1.fc28 fedora 399 k
freeipa-server-dns noarch 4.6.90.pre1-6.1.fc28 fedora 73 k     
freeipa-server-trust-ad x86_64 4.6.90.pre1-6.1.fc28 fedora 155 k
python3-ipatests noarch 4.6.90.pre1-6.1.fc28 fedora 1.0 M

These are installed to a docker image: https://hub.docker.com/r/dogtagpki/pki-ci/builds/b5ozupfu7ad6zmmoolfseml/
Edited by dmoluguw

I was not able to reproduce this problem running xmlrpc tests with ipa git master and pki git master (on f28).

Packages:

[root@master freeipa]# rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
freeipa-server-4.6.90test-0.fc28.x86_64
freeipa-client-4.6.90test-0.fc28.x86_64
389-ds-base-1.4.0.8-1.fc28.x86_64
pki-ca-10.6.1-2.fc28.noarch
krb5-server-1.16.1-2.fc28.x86_64

As Fraser said, it seems that the problem was fixed by PR 1752.

So, I'm closing this as fixed, ok @dmoluguw ?

Sure @fbarreto you can go ahead. Out of curiosity, will there be an IPA 4.6 COPR release for F28? Coz, we don't want to grab the packages from the fedora OR updates repo as these might not be idempotent when we update our docker images. Thanks for the assistance!

Closing as duplicate of https://pagure.io/freeipa/issue/7466.

Metadata Update from @ftweedal:
- Issue close_status updated to: duplicate
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.