[freeipa PR#837][opened] ca-add: fix permission issue

[frasertweedale]

   URL: https://github.com/freeipa/freeipa/pull/837
Author: frasertweedale
 Title: #837: ca-add: fix permission issue
Action: opened

PR body:
"""
The ca-add command pre_callback uses ldap.can_add() to check whether
the user has permission to add CAs.  Alas, the GetEffectiveRights
control used by ldap.can_add() doesn't correctly interpret ACIs with
'targetfilter' constraints, and returns a false-negative for
non-admin users, even when they have the 'System: Add CA'
permission.

To work around this, add the CA object to FreeIPA before attempting
to create the CA in Dogtag.  If the CA creation in Dogtag succeds,
the user then updates the FreeIPA object with the Authority ID and
other authoritative data returned by Dogtag.  If the CA creation in
Dogtag fails, the user cleans up by deleting the newly-created CA
object from FreeIPA.

This modified procedure ensures that the user certainly has the
'System: Add CA' permission before the CA creation in Dogtag is
attempted.  But it also means that the user must have 'write' and
'delete' permission on 'ipaca' objects in FreeIPA, so that it can
complete the object after CA creation in Dogtag, or clean up if that
step fails.  Therefore, update the 'System: Add CA' permission to
confer 'write' and 'delete' access on 'ipaca' objects, as well as
'add' access.

Fixes: https://pagure.io/freeipa/issue/6609
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/837/head:pr837
git checkout pr837

[freeipa PR#837][synchronized] ca-add: fix permission issue

[frasertweedale]

   URL: https://github.com/freeipa/freeipa/pull/837
Author: frasertweedale
 Title: #837: ca-add: fix permission issue
Action: synchronized

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/837/head:pr837
git checkout pr837

[freeipa PR#837][comment] ca-add: fix permission issue

[rcritten]

  URL: https://github.com/freeipa/freeipa/pull/837
Title: #837: ca-add: fix permission issue

rcritten commented:
"""
Is there a bug filed on the GER issue?
"""

See the full comment at
https://github.com/freeipa/freeipa/pull/837#issuecomment-305473444

[freeipa PR#837][comment] ca-add: fix permission issue

[frasertweedale]

  URL: https://github.com/freeipa/freeipa/pull/837
Title: #837: ca-add: fix permission issue

frasertweedale commented:
"""
@rcritten yes: https://pagure.io/389-ds-base/issue/49278
"""

See the full comment at
https://github.com/freeipa/freeipa/pull/837#issuecomment-305474305

[freeipa PR#837][comment] ca-add: fix permission issue

[rcritten]

  URL: https://github.com/freeipa/freeipa/pull/837
Title: #837: ca-add: fix permission issue

rcritten commented:
"""
Ok cool. I shouldn't have been so terse in my previous comment, what I should have
added was "does it make sense to include a pointer to the bug as a hint so workaround
can be removed some time in the future?"

This PR is sort of a brute-force solution but given the infrequency it will be executed it
seems perfectly reasonable.
"""

See the full comment at
https://github.com/freeipa/freeipa/pull/837#issuecomment-305500636

[freeipa PR#837][comment] ca-add: fix permission issue

[frasertweedale]

  URL: https://github.com/freeipa/freeipa/pull/837
Title: #837: ca-add: fix permission issue

frasertweedale commented:
"""
On Thu, Jun 01, 2017 at 06:55:59AM -0700, Rob Crittenden wrote:
>  Ok cool. I shouldn't have been so terse in my previous comment,
> what I should have added was "does it make sense to include a pointer to the bug as a
> hint so workaround can be removed some time in the future?"
>  
>  This PR is sort of a brute-force solution but given the infrequency it will be executed
> it seems perfectly reasonable.
>   
Good idea; I'll add a link to the bug in the patch itself.

"""

See the full comment at
https://github.com/freeipa/freeipa/pull/837#issuecomment-305653601

[freeipa PR#837][synchronized] ca-add: fix permission issue

[frasertweedale]

   URL: https://github.com/freeipa/freeipa/pull/837
Author: frasertweedale
 Title: #837: ca-add: fix permission issue
Action: synchronized

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/837/head:pr837
git checkout pr837

[freeipa PR#837][closed] ca-add: fix permission issue

[frasertweedale]

   URL: https://github.com/freeipa/freeipa/pull/837
Author: frasertweedale
 Title: #837: ca-add: fix permission issue
Action: closed

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/837/head:pr837
git checkout pr837