Uploaded image for project: 'EJBCA'
  1. EJBCA
  2. ECA-8515

Peer connector missing permissions when Approval management is set

    Details

    • Issue discovered during:
      Customer
    • Sprint:
      EJBCA Team Alice - 2019 w37

      Description

      When looking at the permissions for a role, if you are allowed to approve an end entity
      /ra_functionality/approve_end_entity allow
      then you are also allowed to view approvals, reasonable.

      When creating peer connectors there is a setting "Approval management", setting the above to true or false, but it is not setting
      /ra_functionality/view_approvals which is a subset of approve_end_entity.

      This leads to the following situation:
      An admin with approval permissions can view the Manage Requests page on both the CA and the RA.
      An admin with only view permission (view permission is default for the RA role) can view the Manage Requests page on the CA's RA web but not on the RA's because the peer connector's has view_approvals set to false. So when the admin has requested a certificate he can not view the status of waiting and approved certificates for which the admin has requested.

      If the peer connector is set to allow Approval management so that approvals can be handled from the RA, should not the setting
      /ra_functionality/view_approvals
      be set to true as well then so that those with view permissions can view the approvals as well?

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              bastianf Bastian Fredriksson
              Reporter:
              berke Kerim Bergström
              Verified by:
              Amin Khorsandi
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 20 minutes
                  20m