required access rules for /ejbca-rest-api/v2/certificate/search?

[uedvt359]

Hi all, I'm trying to look up certificates (using their serial number, but other attributes produce the same results) using the REST API.

I have to EE profiles (both issued by the same CA, in this case RSA-C1). Searching for certificates in EE1 works, but EE2 does not, unless I use the super-admin account. My query is as follows:

curl -s -E ejbca-auth.pem https://ejbca:8443/ejbca/ejbca-rest-api/v2/certificate/search -H "content-type: application/json" -d '{ "criteria": [ {"property": "QUERY", "operation":"EQUAL", "value": "3ab9f48546d689ac02237678811a74dfd255e87d"} ], "pagination": {"page_size": 10, "current_page": 1} }'|jq .

{
  "certificates": [],
  "pagination_summary": {
    "page_size": 10,
    "current_page": 1
  }
}

These permissions are set for the user identified with ejbca-auth.pem:

/administrator/         Allow
/ca/ECC-C1/     Allow   
/ca/RSA-C1/     Allow   
/ca_functionality/create_certificate/   Allow
/ca_functionality/use_approval_request_id/      Allow
/ca_functionality/use_username/         Allow
/endentityprofilesrules/EE1/create_end_entity/  Allow
/endentityprofilesrules/EE1/edit_end_entity/    Allow
/endentityprofilesrules/EE1/revoke_end_entity/  Allow
/endentityprofilesrules/EE1/view_end_entity/    Allow
/endentityprofilesrules/EE1/view_end_entity_history/    Allow
/endentityprofilesrules/EE2/create_end_entity/  Allow   
/endentityprofilesrules/EE2/edit_end_entity/    Allow
/endentityprofilesrules/EE2/revoke_end_entity/  Allow
/endentityprofilesrules/EE2/view_end_entity/    Allow
/endentityprofilesrules/EE2/view_end_entity_history/    Allow
/ra_functionality/create_end_entity/    Allow
/ra_functionality/edit_end_entity/      Allow
/ra_functionality/revoke_end_entity/    Allow

What am I missing?
Again, if I use the superuser (which has Allow /), certificates from both EEs can be found, but my API user can only find certs of EE1.

[0xshubhs]

The empty result is by design. Unauthorized end entity profiles get filtered out of the search, so it looks like no certificates matched rather than a 403.

EndEntityProfileSessionBean.isAuthorizedToProfile:273:

if (authorizationSession.isAuthorizedNoLogging(admin,
        ENDENTITYPROFILEBASE + "/" + profileId + endentityAccessRule)) {
    authorizedToProfile = true;
    for (final int caId : availableCaIds) {
        if (!authorizedCaIds.contains(caId) && (!hasRootRuleAccess || allCaIds.contains(caId))) {
            authorizedToProfile = false;

Two things needed:

1. /endentityprofilesrules/EE2/view_end_entity/. Your paste cuts off before the EE2 block so check it's there.
2. /ca/<X>/ for every CA in EE2's Available CAs list, not just the issuing one. One missing entry breaks the loop and drops the profile.

Number 2 fits your symptom. Both certs are from RSA-C1, but if EE2 also lists a third CA you don't have /ca/ on, EE2 vanishes and EE1 survives. Super admin hits the hasRootRuleAccess branch.

Turn on DEBUG for org.ejbca.core.ejb.ra.raadmin.EndEntityProfileSessionBean and rerun. Line 286 logs Profile <id> not authorized to CA with ID <caid> and names it.

[uedvt359]

thanks!

the issue was as you described:

• EE1 used to be issued by /ca/legacy1 and was switched to /ca/RSA-C1
• EE2 used to be issued by /ca/legacy2 and was switched to /ca/RSA-C1
• the service user had access to /ca/legacy1 but not /ca/legacy2