[BUG] Key-pair generation should not be proposed if EE profile does not allow it (new request)

[benoiton]

With EJBCA CE v9.3.7, Wildfly 35, PostgreSQL 16, Java 21, on Rocky 9. Firefox 152.

Context

• Brand new CA
• New CA profile from ENDUSER
  • ECDSA P-256
  • only my new CA
• New EE profile
  • only my new CA profile
  • only my new CA
  • only P12 token

New request on RA

Commands with an "operator" account, on a role which has no right for cert creation.

• Certificate type: my EE profile
• Key-pair generation: By the CA
• Username, password, email
• (double) click on "Download PKCS#12"

A warning message appears: "You are not authorized to execute this operation "

The EE is created, with "New" status.

New test key-pair generation set at "Postpone" succeed. (Only PKCS#12 token is possible)

=> The choice for key-pair generation should not be proposed.

[primetomas]

If this is for the RA UI->Make new Request page, it seems to have been fixed already, in the next upcoming release. When selecting only P12 in the EE profile I get only P12 as download button.

[primetomas]

If there is another path I did not discover, please re-open.

[benoiton]

Not sure it's the very issue.
(I've no right to reopen the issue)

On /ejbca/ra/enrollmakenewrequest.xhtml:

If I choose "By the CA", I get an error:

It's expected since the user "Op1" is not allowed to create a certificate. The user "Op1" can just create the EE (with or without an approval workflow). The EE should retrieve her certificate by herself.

In server.log:

INFO  [org.cesecore.audit.impl.log4j.Log4jDevice] (default task-5: 05193673) 2026-09-01 15:06:51+02:00;RA_ADDENDENTITY;SUCCESS;RA;CORE;CN=Op1,OU=XX;1983700902;;test_260801_2;msg=Added end entity test_260801_2.;caid=1983700902;cardnumber=;certificateprofileid=1027049383;endentityprofileid=785149003;extendedInformation= [version:4.0], [type:0], [subjectdirattributes:], [maxfailedloginattempts:-1], [remainingloginattempts:-1], [KEYSTORE_ALGORITHM_TYPE:ECDSA], [KEYSTORE_ALGORITHM_SUBTYPE:P-256]};status=10;subjectAltName=;subjectDN=CN=test_260801_2;subjectEmail=B64:dGVzdF8yNjA4MDFfMkBncmQueHg=;timecreated=Tue Sep 01 15:06:51 CEST 2026;timemodified=Tue Sep 01 15:06:51 CEST 2026;tokentype=2;type=1;username=B64:dGVzdF8yNjA4MDFfMg==
INFO  [org.ejbca.ra.EnrollMakeNewRequestBean] (default task-5: 05193673) CN=Op1,OU=XX is not authorized to execute this operation: org.cesecore.authorization.AuthorizationDeniedException: Admin 'CN=Op1,OU=XX' is not authorized to create certificate from CA 1983700902.

[primetomas]

I see, it's not what I thought. It is the admin user clicking "make new request" that does not have enough authorization to actually perform the request.

[benoiton]

The admin can create the EE, but not create a certificate.

/administrator/ ALLOW
/ca/ ALLOW
/ca_functionality/activate_ca/ ALLOW
/ca_functionality/create_crl/ ALLOW
/ca_functionality/view_approval_profiles/ ALLOW
/ca_functionality/view_ca/ ALLOW
/ca_functionality/view_certificate/ ALLOW
/ca_functionality/view_certificate_profiles/ ALLOW
/cryptotoken/ ALLOW
/cryptotoken/delete/ DENY
/cryptotoken/keys/generate/ DENY
/cryptotoken/keys/remove/ DENY
/cryptotoken/modify/ DENY
/endentityprofilesrules/ ALLOW
/endentityprofilesrules/EMPTY/ DENY
/endentityprofilesrules/EMPTY/view_end_entity/ ALLOW
/endentityprofilesrules/EMPTY/view_end_entity_history/ ALLOW
/internalkeybinding/view/ ALLOW
/ra_functionality/approve_end_entity/ ALLOW
/ra_functionality/create_end_entity/ ALLOW
/ra_functionality/edit_end_entity/ ALLOW
/ra_functionality/revoke_end_entity/ ALLOW
/ra_functionality/view_approvals/ ALLOW
/ra_functionality/view_end_entity/ ALLOW
/ra_functionality/view_end_entity_history/ ALLOW
/ra_functionality/view_end_entity_profiles/ ALLOW