[BUG] "Approve actions" list is empty

[benoiton]

There seems to be an issue about approval request listing

Context

We have an approval profile enabled on a certificate profile for "Add/Edit End Entity".
It's a simple partition approval. It can be seen by anybody and one role "validator" can approve.
When an end entity is set to "new", mail is correctly sent.

Behavior

• On /adminweb/approval/approvalactions.xhtml, no approval request is listed (with either superadmin or validator role).
• On /ra/managerequests.xhtml?tab=to_approve, no approval request is listed (with either superadmin or validator role).
• On /ra/managerequests.xhtml?tab=pending, superadmin can see the "Waiting for Approval" request, and validator see nothing.
• On /ra/managerequests.xhtml?tab=custom_search, the "Waiting for Approval" request is listed for superadmin and validator. The validator can review and approve.

Deployment

Software, EJBCA 8.2.0.1 and 8.3.2 Community

[benoiton]

Certificate approval is expected not to be shown on adminweb.

I found query.add(ApprovalMatch.MATCH_WITH_APPROVALTYPE, BasicMatch.MATCH_TYPE_EQUALS, Integer.toString(ApprovalDataVO.APPROVALTYPE_ACTIVATECATOKEN), Query.CONNECTOR_AND); in modules/admin-gui/src/org/ejbca/ui/web/admin/approval/ListApproveActionManagedBean.java.

Searching in release notes, it's bound to ECA-7391: since v7.5, only show CA-related approvals in CA Web (and vice versa).

I go on my investigations on RA behavior.

[benoiton]

Expected behavior?

In RaApprovalRequestInfo.java, I see:

/** Is waiting for someone else to do something */
public boolean isPending(final List<Role> roles) {
    return !isWaitingForMe(roles) && !isProcessed();
}

I understand "Pending Approval" is mutually exclusive with "To Approve".

The doc page Managing_Requests_in_the_RA_UI.html says different things about pending approval:

• At the beginning of the page: "lists currently pending requests you have access to view, including those that you may approve yourself"
• At the end of the page: "this tab displays the requests that you have made, and that are waiting for approval by another administrator"

The 2nd sentence seems to comply with the code. The first sentence should be corrected.

Real behevior

The RA behavior is unexpected:

• The user who requested the new EE:
  • To approve: nothing => correct
  • Pending Approval: requested EE listed => correct
• A user with the approval role:
  • To approve: nothing => bug
  • Pending Approval: nothing => correct
• Another user without the approval role (with /ra_functionality/approve_end_entity/ right, but without the /endentityprofilesrules/NAME/approve_end_entity/ for the requested EE)
  • To approve: nothing => correct
  • Pending Approval: requested EE listed => bug or not, depending of the "pending" definition. (The user can see but not approve)

In RaManageRequestsBean.java, lines 185 to 193, result is filtered. I don't understand why since it was already filtered in RaMasterApiSessionBean.java, lines 937 to 947. When I remove this 2nd filtering in RaManageRequestsBean.java, the user with approval role is correctly displayed the request they has to approve (or not). My investigation shows the line is filtered by RaManageRequestsBean.java because raInfoMap is empty (line 185).

[primetomas]

Hi Benoit,

Thanks for the discussion. Approvals is a bit tricky, but I'll try to make an approval run to look at this soon.