#6972 Replica installation grants HTTP principal access in WebUI
Closed: fixed 6 years ago Opened 6 years ago by pvoborni.

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1452216

Please note that this Bug is private and may not be accessible as it contains confidential Red Hat customer information.

Created attachment 1280051
gssproxy log from the replica installations

Description of problem:
When I install replica against an IPA server with external CA (does not
necessary have to be, didn't test normal CA/CA-less setups) and log in as a
common user, after uninstalling and installing the replica again, I become HTTP
principal when I refresh the page where I was previously logged.

Version-Release number of selected component (if applicable):
git master

How reproducible:
100%

Steps to Reproduce:
1. install IPA server
2. create a user with a password
3. log in as that user, set its password
4. install a replica against the IPA server, specifying --no-pkinit
5. log in as the created user to the Web UI using the password from step 3,
stay on the page
6. uninstall replica
7. install the replica, again specifying the --no-pkinit option
8. after the installation is complete, refresh the page in the browser from
step 5
9. you are now an HTTP principal in the Web UI

Actual results:
You become HTTP principal

Expected results:
You are either logged off or at least stay the same user.

Additional info:
The log contains information from the gssproxy daemon in debug mode with
debug_level set to 2.
In the reproducing steps, I am using
https://replica.example.com/ipa/ui/#/e/user/search as the page in the browser.

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1452216

6 years ago

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1452216

6 years ago

Metadata Update from @mbasti:
- Issue set to the milestone: FreeIPA 4.5.2

6 years ago

master:

  • 83619e8 Fix rare race condition with missing ccache file

ipa-4-5:

  • 90b432b Fix rare race condition with missing ccache file

Metadata Update from @mbasti:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

6 years ago

Login to comment on this ticket.

Metadata