BootstrapIdentityWithYubikeySecondFactorCommand fails

[pmeulen]

Bootstrapping Stepup-Middleware 7.0.1 fails with an automatisation error:

When using bootstrap-admin-sraa.sh from OpenConext-devconf the console command middleware:bootstrap:identity-with-yubikey fails:

docker compose exec middleware /var/www/html/bin/console middleware:bootstrap:identity-with-yubikey urn:collab:person:dev.openconext.local:admin dev.openconext.local "Admin (SRAA)" admin@dev.openconext.local en_EN 12345678

The issue is that the console command is not authorised. However the console command is the only thing that is authorized to run this command:

{"message":"Client is not authorized to execute command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Configuration\\Command\\CreateInstitutionConfigurationCommand[352fa472-4cf7-449f-8b99-97865aa0b6ed]\", it does not have (one of) the required role(s) \"ROLE_MANAGEMENT\"","context":{},"level":400,"level_name":"ERROR","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}

Full log:

{"message":"Starting Transaction in TransactionAwarePipeline for processing command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Requesting inner pipeline to process command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Processing \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Invoking stage \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Pipeline\\AuthorizingStage\" for \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Processing authorization for command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"No authorization required for command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Stage \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Pipeline\\AuthorizingStage\" finished processing \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Invoking stage \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Pipeline\\ValidationStage\" for \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Processing validation for \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\" is valid","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Stage \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Pipeline\\ValidationStage\" finished processing \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Invoking stage \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Pipeline\\DispatchStage\" for \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Dispatching command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\" for handling","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\" has been handled","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Stage \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Pipeline\\DispatchStage\" finished processing \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Invoking stage \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Pipeline\\EventDispatchingStage\" for \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Dispatching Events for \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Starting Transaction in TransactionAwarePipeline for processing command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Configuration\\Command\\CreateInstitutionConfigurationCommand[352fa472-4cf7-449f-8b99-97865aa0b6ed]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Requesting inner pipeline to process command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Configuration\\Command\\CreateInstitutionConfigurationCommand[352fa472-4cf7-449f-8b99-97865aa0b6ed]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Processing \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Configuration\\Command\\CreateInstitutionConfigurationCommand[352fa472-4cf7-449f-8b99-97865aa0b6ed]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Invoking stage \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Pipeline\\AuthorizingStage\" for \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Configuration\\Command\\CreateInstitutionConfigurationCommand[352fa472-4cf7-449f-8b99-97865aa0b6ed]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Processing authorization for command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Configuration\\Command\\CreateInstitutionConfigurationCommand[352fa472-4cf7-449f-8b99-97865aa0b6ed]\"","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Client is not authorized to execute command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Configuration\\Command\\CreateInstitutionConfigurationCommand[352fa472-4cf7-449f-8b99-97865aa0b6ed]\", it does not have (one of) the required role(s) \"ROLE_MANAGEMENT\"","context":{},"level":400,"level_name":"ERROR","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Exception occurred while processing command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Configuration\\Command\\CreateInstitutionConfigurationCommand[352fa472-4cf7-449f-8b99-97865aa0b6ed]\": \"Processing of Command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Configuration\\Command\\CreateInstitutionConfigurationCommand[352fa472-4cf7-449f-8b99-97865aa0b6ed]\" is forbidden.\", rolling back transaction","context":{"exception":{"class":"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Exception\\ForbiddenException","message":"Processing of Command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Configuration\\Command\\CreateInstitutionConfigurationCommand[352fa472-4cf7-449f-8b99-97865aa0b6ed]\" is forbidden.","code":0,"file":"/var/www/html/src/Surfnet/StepupMiddleware/CommandHandlingBundle/Pipeline/AuthorizingStage.php:74"}},"level":400,"level_name":"ERROR","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware","art":"13445"}}
{"message":"Transaction for command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Configuration\\Command\\CreateInstitutionConfigurationCommand[352fa472-4cf7-449f-8b99-97865aa0b6ed]\" rolled back, re-throwing exception","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
{"message":"Exception occurred while processing command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\": \"Processing of Command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Configuration\\Command\\CreateInstitutionConfigurationCommand[352fa472-4cf7-449f-8b99-97865aa0b6ed]\" is forbidden.\", rolling back transaction","context":{"exception":{"class":"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Exception\\ForbiddenException","message":"Processing of Command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Configuration\\Command\\CreateInstitutionConfigurationCommand[352fa472-4cf7-449f-8b99-97865aa0b6ed]\" is forbidden.","code":0,"file":"/var/www/html/src/Surfnet/StepupMiddleware/CommandHandlingBundle/Pipeline/AuthorizingStage.php:74"}},"level":400,"level_name":"ERROR","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware","art":"13445"}}
{"message":"Transaction for command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Identity\\Command\\BootstrapIdentityWithYubikeySecondFactorCommand[cbc06d47-2a9a-414b-948e-8ef86b538b50]\" rolled back, re-throwing exception","context":{},"level":100,"level_name":"DEBUG","channel":"app","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}
An Error occurred when trying to bootstrap the token for identity: "Processing of Command "Surfnet\StepupMiddleware\CommandHandlingBundle\Configuration\Command\CreateInstitutionConfigurationCommand[352fa472-4cf7-449f-8b99-97865aa0b6ed]" is forbidden."                                                                                                                                                     
{"message":"Error thrown while running command \"middleware:bootstrap:identity-with-yubikey 'urn:collab:person:dev.openconext.local:admin' 'dev.openconext.local' 'Admin (SRAA)' 'admin@dev.openconext.local' en_GB 12345678\". Message: \"Processing of Command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Configuration\\Command\\CreateInstitutionConfigurationCommand[352fa472-4cf7-449f-8b99-97865aa0b6ed]\" is forbidden.\"","context":{"exception":{"class":"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Exception\\ForbiddenException","message":"Processing of Command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Configuration\\Command\\CreateInstitutionConfigurationCommand[352fa472-4cf7-449f-8b99-97865aa0b6ed]\" is forbidden.","code":0,"file":"/var/www/html/src/Surfnet/StepupMiddleware/CommandHandlingBundle/Pipeline/AuthorizingStage.php:74"},"command":"middleware:bootstrap:identity-with-yubikey 'urn:collab:person:dev.openconext.local:admin' 'dev.openconext.local' 'Admin (SRAA)' 'admin@dev.openconext.local' en_GB 12345678","message":"Processing of Command \"Surfnet\\StepupMiddleware\\CommandHandlingBundle\\Configuration\\Command\\CreateInstitutionConfigurationCommand[352fa472-4cf7-449f-8b99-97865aa0b6ed]\" is forbidden."},"level":500,"level_name":"CRITICAL","channel":"console","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware","art":"13445"}}
{"message":"Command \"middleware:bootstrap:identity-with-yubikey 'urn:collab:person:dev.openconext.local:admin' 'dev.openconext.local' 'Admin (SRAA)' 'admin@dev.openconext.local' en_GB 12345678\" exited with code \"1\"","context":{"command":"middleware:bootstrap:identity-with-yubikey 'urn:collab:person:dev.openconext.local:admin' 'dev.openconext.local' 'Admin (SRAA)' 'admin@dev.openconext.local' en_GB 12345678","code":1},"level":100,"level_name":"DEBUG","channel":"console","datetime":"2026-07-28T13:34:15+02:00","extra":{"request_id":"7a02f11787d2e6849b60acd0da5788e9","application":"middleware"}}

In AuthorizingStage.php line 74:
                                                                                                                                                                                          
  Processing of Command "Surfnet\StepupMiddleware\CommandHandlingBundle\Configuration\Command\CreateInstitutionConfigurationCommand[352fa472-4cf7-449f-8b99-97865aa0b6ed]" is forbidden.

middleware:bootstrap:identity-with-yubikey <name-id> <institution> <common-name> <email> <preferred-locale> <yubikey>

Error: Failed to bootstrap the admin user

[pmeulen]

Reproduce:

0. Pull docker image to use Stepup-Middleware fa8114 2026-07-23 13:17:47 7.0.1
1. Start with a clean database (clear-database.sh)
2. start-dev-env.sh
3. bootstrap-database.sh
4. bootstrap-admin-sraa.sh