freeipa

#8440 CA-less install does not set required permissions on KDC certificate
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

When ipa server/replica is installed in CA-less mode with a KDC certificate, the KDC cert is installed in /var/kerberos/krb5kdc/kdc.crt but the permissions are left as 0600 and this breaks WebUI authentication

Steps to Reproduce

  1. install CA_less ipa server with ipa-server-install [...] --pkinit-cert-file /path/to/kdc.p12
  2. check the permissions on /var/kerberos/krb5kdc/kdc.crt
  3. install CA-less ipa replica with ipa-replica-install [...] --pkinit-cert-file /path/to/kdc.p12
  4. check the permissions on /var/kerberos/krb5kdc/kdc.crt

Actual behavior

The file has 600 root:root permissions. Connection to the WebGUI fails.

Expected behavior

The file should have 644 root:root permissions. Connection to the WebGUI should succeed.

Metadata Update from @frenaud:
- Issue assigned to frenaud

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1863616

Issue linked to Bugzilla: Bug 1863616

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/4974
- Custom field rhbz reset (from https://bugzilla.redhat.com/show_bug.cgi?id=1863616)
- Issue set to the milestone: FreeIPA 4.8.9

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1863616, https://bugzilla.redhat.com/show_bug.cgi?id=1863619

Issue linked to Bugzilla: Bug 1863619

master:

  • 9335bd9299e54928a057cbd31de40aca0ef207b2 CAless installation: set the perms on KDC cert file
  • a26e0ba558aa76323d90b807f2201992d6ee58b4 ipatests: check KDC cert permissions in CA less install

ipa-4-6:

  • 9c9b9fd5854badc3fa65bbda7648cacbb35b0436 CAless installation: set the perms on KDC cert file
  • 87ba8c50d79526021e938c0fcf8150d7a342c863 ipatests: check KDC cert permissions in CA less install

ipa-4-8:

  • 81c955e561dd42ab70a39bf636c90e82a9d7d899 CAless installation: set the perms on KDC cert file
  • 295dd4235f693b7b4b4270b46a28cb6e7b3d00b4 ipatests: check KDC cert permissions in CA less install

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/4974
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.