Closed astro2000j closed 7 months ago
Thanks for the issue. The one item I see missing is the problem and/or error with this, the 'actual behavior' section. I'm trying to understand if this is an issue with the module or the api.
@gdbarron i tagged the section (link in the description) where the behavior occurs. I found in the $error variable that the function was executing the Add-TppCertificateAssociation
while trying to create the application group using the New-TppObject
. The function evaluates if the certificate attribute exists in the payload. If it returns true, the association is attempted.
The application group needs the this config, but the application group isn’t an application object and this is what is causing the error. This seems to be coming from TPP which doesn’t allow a certificate association if the object is not an application type.
Here is the error:
Invoke-WebRequest: /Users/nelson.buya/.local/share/powershell/Modules/VenafiPS/5.8.1/Public/Invoke-VenafiRestMethod.ps1:254:40
Line |
254 | … put = $($response = Invoke-WebRequest @params -ErrorAction Stop) 4>&1
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| {"Error":"Application object error. \"PKCS11 Application Group\" is not
| an Application object of DN
| \"\\VED\\Policy\\PKCS11-Win\\testapi.lab.securafi.net - Pkcs11 App
| Group\".","Success":false}
Here is the method stack from the $error:
PS /Users/nelson.buya> $err.Data.Values
MethodName
----------
Invoke-VenafiRestMethod
Add-TppCertificateAssociation<Process>
New-TppObject
<ScriptBlock>
<ScriptBlock>
Invoke-VenafiRestMethod
Add-TppCertificateAssociation<Process>
New-TppObject
<ScriptBlock>
<ScriptBlock>
Invoke-VenafiRestMethod
Add-TppCertificateAssociation<Process>
New-TppObject
<ScriptBlock>
<ScriptBlock>
Invoke-VenafiRestMethod
Add-TppCertificateAssociation<Process>
New-TppObject
<ScriptBlock>
<ScriptBlock>
This issue is stale because it has been open for 60 days with no activity.
This issue is stale because it has been open for 60 days with no activity.
This issue was closed because it has been inactive for 30 days since being marked as stale.
Issue:
While calling the
New-TppObject
when creating an application object (1-to-many feature), a certificate path is supplied to associate the application group to a single certificate object.Replicate:
Expected Behavior:
When specifying an
Application Group
SuperClass type for the-Class
parameter (i.e. - PKCS11 Application Group), the certificate association logic should be ignored.Alternatively, adding a new parameter such as
-SkipCertificateAssociation
enables the developer to control when the certificate association logic is executed when creating a new object.Workaround
Perform first call using the
New-TppObject
and exclude theCertificate
attribute during creation. Then call theSet-TppAttribute
to update the Application Group object with the "associated" certificate.https://github.com/Venafi/VenafiPS/blob/b357a4247c320847089273fb84cd6bed6a60e1de/VenafiPS/Public/New-TppObject.ps1#L191C35-L191C35