Project

General

Profile

Bug #3300

FWD Admin: Certificate delete may lead to inconsistent directory

Added by Hynek Cihlar almost 7 years ago. Updated almost 7 years ago.

Status:
New
Priority:
Normal
Assignee:
-
Target version:
-
Start date:
Due date:
% Done:

0%

billable:
No
vendor_id:
GCD
case_num:
version:

History

#1 Updated by Hynek Cihlar almost 7 years ago

To reproduce, in FWD Admin assign a certificate to a user account. Create an ACL referencing the user account. Delete the certificate. The result will be an inconsistent directory, i.e. on subsequent server start the following exception will be thrown and the server process will terminate.

com.goldencode.p2j.cfg.ConfigurationException: directory object /security/acl/majic-action/000200/subjects refers to non-existing account the-account-name-with-deleted-certificate
    at com.goldencode.p2j.security.SecurityCache.createACL(SecurityCache.java:3124)
    at com.goldencode.p2j.security.SecurityCache.readACLs(SecurityCache.java:2271)
    at com.goldencode.p2j.security.SecurityCache.<init>(SecurityCache.java:489)
    at com.goldencode.p2j.security.SecurityCache.<init>(SecurityCache.java:343)
    at com.goldencode.p2j.security.SecurityManager.<init>(SecurityManager.java:670)
    at com.goldencode.p2j.security.SecurityManager.createInstance(SecurityManager.java:750)
    at com.goldencode.p2j.main.StandardServer.bootstrap(StandardServer.java:802)
    at com.goldencode.p2j.main.ServerDriver.start(ServerDriver.java:464)
    at com.goldencode.p2j.main.CommonDriver.process(CommonDriver.java:444)
    at com.goldencode.p2j.main.ServerDriver.process(ServerDriver.java:196)
    at com.goldencode.p2j.main.ServerDriver.main(ServerDriver.java:805)

User accounts with missing certificate are ignored during directory loading. But ACLs with such ignored accounts are loaded, this leads to the inconsistency.

What is the expected behavior when a referenced certificate is deleted when the referring account is itself referenced from an ACL?

Also available in: Atom PDF