Currently the subsystem user is named based on the first subsystem that registers the certificate. On shared instance the second subsystem registering the same certificate will get the same user as the first subsystem. While the mapping works fine, it could be confusing.
For example, when KRA receives CA certificate registration it will create a CA-<hostname>-<port> user. Later when KRA receives TPS certificate registration it will reuse the same user instead of TPS-<hostname>-<port>.
Proposed changes: on shared instance the CA and TPS certificate should be mapped to a generic PKI-<hostname>-<port> user. A manual database upgrade procedure may be needed to change the user name in existing database.
Related issue: The pki_shared_db flag is used inconsistently across subsystems. By default, the flag is set to False in CA, and true in other subsystems, although they are all using the same database.
Proposed milestone: 10.2 backlog
See also: http://pki.fedoraproject.org/wiki/Subystem_Certificates
Metadata Update from @edewata: - Issue set to the milestone: UNTRIAGED
Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.
This issue has been cloned to GitHub and is available here: https://github.com/dogtagpki/pki/issues/1576
If you want to receive further updates on the issue, please navigate to the GitHub issue and click on Subscribe button.
Subscribe
Thank you for understanding, and we apologize for any inconvenience.
Metadata Update from @dmoluguw: - Issue close_status updated to: migrated - Issue status updated to: Closed (was: Open)
Login to comment on this ticket.