From a589107d8362bed238f3cdf1662914665b705c0b Mon Sep 17 00:00:00 2001
From: Fraser Tweedale <ftweedal@redhat.com>
Date: Wed, 27 May 2020 16:55:05 +1000
Subject: [PATCH 1/2] acme: log in CAClient when submitting certificate request

It is possible to use a lower-privileged RA account to issue
certificates, if the target profile is set up to allow it.
Therefore log in the user before submitting the certificate request.
---
 base/acme/src/main/java/org/dogtagpki/acme/issuer/PKIIssuer.java | 1 +
 1 file changed, 1 insertion(+)

diff --git a/base/acme/src/main/java/org/dogtagpki/acme/issuer/PKIIssuer.java b/base/acme/src/main/java/org/dogtagpki/acme/issuer/PKIIssuer.java
index ecc074a5f..dd7fc3f85 100644
--- a/base/acme/src/main/java/org/dogtagpki/acme/issuer/PKIIssuer.java
+++ b/base/acme/src/main/java/org/dogtagpki/acme/issuer/PKIIssuer.java
@@ -123,6 +123,7 @@ public class PKIIssuer extends ACMEIssuer {
         AuthorityID aid = null;
         X500Name adn = null;
 
+        caClient.login();
         CACertClient certClient = new CACertClient(caClient);
         CertEnrollmentRequest certEnrollmentRequest = certClient.getEnrollmentTemplate(profile);
 
-- 
2.21.0