admin list gives an error

[jsaathof]

Hi,

I have been running for a while now with step-ca for ACME. I wanted to add eab but I got an error. I was asked for an admin and password and encountered an error after entering them.

✔ Please enter admin name/subject (e.g., [email protected]): [email protected]
✔ Provisioner: test (ACME)
error creating admin client: step ACME provisioners do not support token auth flows

I had removed all JWK configuration and did not know that I do not have an admin now.
For testing I have installed step and step-cli on a new server for testing. This was an empty configuration with an admin. But when I try to add or even list the admins I got a new error.

[build]:~
root# step ca admin list
No admin credentials found. You must login to execute admin commands.
✔ Please enter admin name/subject (e.g., [email protected]): [email protected]
✔ Provisioner: [email protected] (JWK) [kid: wDDZYs_NDOetIpGNjx9GLp_wFsnt3pfy7_EkrXpHdDw]
Please enter the password to decrypt the provisioner key:
json: cannot unmarshal number into Go value of type ca.AdminClientError

I have searched the internet for this error but did not find a real answer. I found this: #963 but it was not clear to me on what to do to fix this. I am running both step and step-ca on the same machine. And I do not want to change to a different database.

Bear in mind this is an empty setup and I do not understand what I have configured wrong. This is supposed to work, isn't it?

[udf2457]

@jsaathof did you ever find a solution to this ?

I have tried e.g. --admin-provisioner="Admin JWK" --issuer=myacmename but that doesn't work either ?

[hslatman]

@jsaathof I know this is an old issue, but did you enable remote administration when creating the new CA? We're aware the error is not clear. The step CLI is trying to reach the admin API endpoint, which doesn't exist if remote administration is not enabled. Some docs on this subject are available here: https://smallstep.com/docs/step-ca/provisioners/#remote-provisioner-management.

With remote provisioner management, the provisioners are stored in the same database that your CA already uses for other records it keeps. step ca admin is only supported with remote provisioner management, as it isn't something you need if remote provisioner management is not enabled, as it's primarily functionality is managing the admins that can perform remote administration.

[hslatman]

@udf2457 --admin-provisioner and --provisioner should be usable. Those go combined with step as the default admin user subject, which uses the first JWK provisioner that was created as the "admin provisioner".

[udf2457]

Thanks @hslatman . I'm busy trying to get device-attest-01 working at the moment (#2486) but once I've cracked that I'll return to this. I suspect I probably forgot a CLI flag.