Thank you very much Rob for your time.

The problem is solved.

-----Mensaje original-----
De: Rob Crittenden [mailto:rcrit...@redhat.com]
Enviado el: lunes, 09 de enero de 2012 11:52 a.m.
Para: Ivan Ferreira
CC: freeipa-users@redhat.com
Asunto: Re: [Freeipa-users] Insufficient access: Insufficient 'write' privilege 
to the 'userCertificate' attribute

Ivan Ferreira wrote:
> Hi everybody. I'm testing ipa-server 2.1.3. I'm trying to create a
> Certificate for vsftpd.
>
> I can successfully create the certificate with the following command:
>
> # ipa cert-request --add --principal=FTP/ftp.linux.com.py ftp.csr
>
> But I want to create certificates with subjectAltName DNS extensions,
> and it seems that is not possible through an openSSL CRS and dogtag.
>
> So I deleted the service entry, then I created again using:
>
> # ipa service-add FTP/ftp.linux.com.py
>
> Then, I try to create the certificate using the following command:
>
> # ipa-getcert request -k /etc/vsftpd/private/ftp.key -f
> /etc/vsftpd/certs/ftp.crt -N "cn=ftp.linux.com.py" -D
> "cn=le-303.linux.com.py" -D "cn=ftp" -D "cn=le-303" -K
> FTP/ftp.linux.com.py
>
> But I have the following error:
>
> Request ID '20120108062420':
>
> status: CA_REJECTED
>
> ca-error: Server denied our request, giving up: 2100 (RPC failed at
> server. Insufficient access: Insufficient 'write' privilege to the
> 'userCertificate' attribute of entry
> 'krbprincipalname=ftp/ftp.linux.com...@linux.com.py,cn=services,cn=accounts,dc=linux,dc=com,dc=py'.).
>
> stuck: yes
>
> key pair storage: type=FILE,location='/etc/vsftpd/private/ftp.key'
>
> certificate: type=FILE,location='/etc/vsftpd/certs/ftp.crt'
>
> CA: IPA
>
> issuer:
>
> subject:
>
> expires: unknown
>
> track: yes
>
> auto-renew: yes
>
> It looks like there is a problem with an ACI, or admin principal is
> not having enough privileges.
>
> ¿Anyone gime me some hints?

ipa-getcert executes using the host principal of the machine it is running on. 
If you really want this machine to do the request you can add it as a manager 
to the service:

# ipa service-add-host --hosts=<host_you_are_on> FTP/ftp.linux.com.py # ipa 
resubmit -i 20120108062420

If you don't want certmonger tracking this forever you can tell it to stop once 
the cert is generated with:

# ipa-getcert stop-tracking -i 20120108062420

rob

AVISO LEGAL: Esta información es privada y confidencial y está dirigida 
únicamente a su destinatario. Si usted no es el destinatario original de este 
mensaje y por este medio pudo acceder a dicha información por favor elimine el 
mensaje. La distribución o copia de este mensaje está estrictamente prohibida. 
Esta comunicación es sólo para propósitos de información y no debe ser 
considerada como propuesta, aceptación ni como una declaración de voluntad 
oficial de NUCLEO S.A. La transmisión de e-mails no garantiza que el correo 
electrónico sea seguro o libre de error. Por consiguiente, no manifestamos que 
esta información sea completa o precisa. Toda información está sujeta a 
alterarse sin previo aviso.

This information is private and confidential and intended for the recipient 
only. If you are not the intended recipient of this message you are hereby 
notified that any review, dissemination, distribution or copying of this 
message is strictly prohibited. This communication is for information purposes 
only and shall not be regarded neither as a proposal, acceptance nor as a 
statement of will or official statement from NUCLEO S.A. . Email transmission 
cannot be guaranteed to be secure or error-free. Therefore, we do not represent 
that this information is complete or accurate and it should not be relied upon 
as such. All information is subject to change without notice.

_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Reply via email to