freeipa

#8084 KRA authentication fails when IPA CA has custom Subject DN
Closed: fixed by ftweedal. Opened by ftweedal.

Closed: fixed
Reopen Issue

Issue

When IPA CA has a custom subject DN (i.e. not CN=Certificate Authority,{subject-base}),
KRA authentication always fails, because the description attribute of the uid=ipakra people entry is not set up correctly.

Steps to Reproduce

  1. Install IPA with custom subject DN, e.g. CN=IPA CA 201910021714,DC=redhat,DC=com
  2. Install KRA
  3. Attempt any operation that contacts KRA (e.g. ipa vault-add).

Actual behavior

Communication with KRA fails.

Expected behavior

Communication with KRA succeeds.

Version/Release/Distribution

4.8 and possibly every version of IPA ever (since we supported custom subject DN).

Additional info:

The probably is clearly seen in the following ldapsearch output:

% ldapsearch -LLL -D cn=directory\ manager -w4me2Test -b o=ipaca '(|(uid=ipara)(uid=ipakra))' description |less
dn: uid=ipara,ou=people,o=ipaca
description: 2;7;CN=IPA CA 201910021714,DC=redhat,DC=com;CN=IPA RA,O=IPA.LOCAL
dn: uid=ipakra,ou=people,o=kra,o=ipaca
description: 2;7;CN=Certificate Authority,O=IPA.LOCAL;CN=IPA RA,O=IPA.LOCAL

The probably may be improper initialisation of the KRAInstance object during installation.
See discussion from mailing list:

> This looks like actual IPA RA subject is fixed in the code in                                                      
> ipaserver/install/krainstance.py:                                                                                  
>                                                                                                                    
> class KRAInstance(DogtagInstance):                                                                                 
> .....                                                                                                              
>    def __create_kra_agent(self):                                                                                   
> .....                                                                                                              
>        # create ipakra user with RA agent certificate                                                              
>        user_dn = DN(('uid', "ipakra"), ('ou', 'people'), self.basedn)                                              
>        entry = conn.make_entry(                                                                                    
>            user_dn,                                                                                                
>            objectClass=['top', 'person', 'organizationalPerson',                                                   
>                         'inetOrgPerson', 'cmsuser'],                                                               
>            uid=["ipakra"],                                                                                         
>            sn=["IPA KRA User"],                                                                                    
>            cn=["IPA KRA User"],                                                                                    
>            usertype=["undefined"],                                                                                 
>            userCertificate=[cert],                                                                                 
>            description=['2;%s;%s;%s' % (                                                                           
>                cert.serial_number,                                                                                 
>                DN(self.subject),                                                                                   
>                DN(('CN', 'IPA RA'), self.subject_base))])                                                          
>        conn.add_entry(entry)                                                                                       
>                                                                                                                    
> I think it should be picked up from the cert. Time for a ticket?                                                   
>                                                                                                                    
Time for a ticket, yes.  But the above code looks ok.  The problem                                                   
is 'self.subject' (the issuer DN) contains the wrong value.  I'll                                                    
follow the reproducer steps to see what's going on.  I suspect                                                       
KRAInstance instance is not initialised properly for some operation.

RHEL 7 BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1758406

RHEL 8 BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1758404

PR: https://github.com/freeipa/freeipa/pull/3764

master:

  • 326d417d98b092e175623cd28e46586df00e60a2 krainstance: set correct issuer DN in uid=ipakra entry
  • 7ea50ff76d2ee5367b75d999c2baa2a7a480f34a upgrade: fix ipakra people entry 'description' attribute
  • e767386e7120be3515d6a34529b51ae658248038 test_integration: add tests for custom CA subject DN

Metadata Update from @frenaud:
- Custom field test_case adjusted to ipatests/test_integration/test_ca_custom_sdn.py

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1758406

Issue linked to Bugzilla: Bug 1758406

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1758406, https://bugzilla.redhat.com/show_bug.cgi?id=1758404 (was: https://bugzilla.redhat.com/show_bug.cgi?id=1758406)

Issue linked to Bugzilla: Bug 1758404

ipa-4-8:

  • 09c6db750e542c7c25dd34d5cf25750f34250bd9 krainstance: set correct issuer DN in uid=ipakra entry
  • 23f4e00345c051c3ca7540963a59a3ee91d2ea24 upgrade: fix ipakra people entry 'description' attribute
  • 5d68d04c77c9dc52db810085274b424cf0295b13 (HEAD) test_integration: add tests for custom CA subject DN

ipa-4-7:

  • 1071eb2c64ef94fde13ba7a146d75635b4d56244 krainstance: set correct issuer DN in uid=ipakra entry
  • 4aad2c9b5ed7c7f4b6cba1e0328cf2ff88175d1c upgrade: fix ipakra people entry 'description' attribute
  • 4767add057353280274b884b1bd15f7f63408970 (HEAD) test_integration: add tests for custom CA subject DN

ipa-4-6:

  • 946d96f6c3fd5766d60222da940c27d5d4e41158 krainstance: set correct issuer DN in uid=ipakra entry
  • 2fa8c6903405294f0e11e373db321172663d6cfd upgrade: fix ipakra people entry 'description' attribute
  • 0a0e802bd47188fe31d6bf02b28ef0ea51567194 (HEAD) test_integration: add tests for custom CA subject DN

Metadata Update from @ftweedal:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.