URL: https://github.com/freeipa/freeipa/pull/814 Title: #814: Add new permission to grant 'add' on cas container
frasertweedale commented: """ This problem is actually caused by a bug in a preliminary permission check during `ca_add.pre_callback`, not an ACI issue. I am looking into it, but this is not the solution, so I am NACKing it. """
See the full comment at https://github.com/freeipa/freeipa/pull/814#issuecomment-305072773