{"action":"opened","issue":{"url":"https://api.github.com/repos/chef/chef/issues/2969","labels_url":"https://api.github.com/repos/chef/chef/issues/2969/labels{/name}","comments_url":"https://api.github.com/repos/chef/chef/issues/2969/comments","events_url":"https://api.github.com/repos/chef/chef/issues/2969/events","html_url":"https://github.com/chef/chef/issues/2969","id":58642035,"number":2969,"title":"Chef 12 with Vault and non-admins users","user":{"login":"tiago-cruz-movile","id":4048174,"avatar_url":"https://avatars.githubusercontent.com/u/4048174?v=3","gravatar_id":"","url":"https://api.github.com/users/tiago-cruz-movile","html_url":"https://github.com/tiago-cruz-movile","followers_url":"https://api.github.com/users/tiago-cruz-movile/followers","following_url":"https://api.github.com/users/tiago-cruz-movile/following{/other_user}","gists_url":"https://api.github.com/users/tiago-cruz-movile/gists{/gist_id}","starred_url":"https://api.github.com/users/tiago-cruz-movile/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tiago-cruz-movile/subscriptions","organizations_url":"https://api.github.com/users/tiago-cruz-movile/orgs","repos_url":"https://api.github.com/users/tiago-cruz-movile/repos","events_url":"https://api.github.com/users/tiago-cruz-movile/events{/privacy}","received_events_url":"https://api.github.com/users/tiago-cruz-movile/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-02-23T20:20:08Z","updated_at":"2015-02-23T20:20:08Z","closed_at":null,"body":"Hello,\r\n\r\nThere is some way to give non-admins users permission to use 'knife user show'?\r\n\r\nI tried to\r\n\r\n```\r\n$ knife acl add groups users read group vault-admins\r\n```\r\n\r\nAnd put my users on 'vault-admins' group, but does not work :(\r\n\r\n```\r\nValid OBJECT_TYPE's are\r\n\r\nclients\r\ngroups\r\ncontainers\r\ndata\r\nnodes\r\nroles\r\ncookbooks\r\nenvironments\r\n```\r\n\r\nThe problem is: knife-vault needs to get public key of the users to generate the hash.\r\n\r\nIf the guy is a non-admin, he only can generate for his own, and I can't see the key:\r\n\r\n```\r\n$ knife vault show reliability portability-credentials\r\nERROR: ChefVault::Exceptions::SecretDecryption: reliability/portability-credentials is not encrypted with your public key.  Contact an administrator of the vault item to encrypt for you!\r\n```\r\n\r\nAnd the guy who did, can't generate to me because the can't see my private key using 'knife user show tiago_cruz'\r\n\r\nSo, how can I give him access to my private_key?\r\n\r\nThanks a lot!\r\n\r\n```\r\n$ knife user show tiago_cruz -VV   \r\nDEBUG: Chef::HTTP calling Chef::HTTP::JSONInput#handle_request\r\nDEBUG: Chef::HTTP calling Chef::HTTP::JSONToModelOutput#handle_request\r\nDEBUG: Chef::HTTP calling Chef::HTTP::CookieManager#handle_request\r\nDEBUG: Chef::HTTP calling Chef::HTTP::Decompressor#handle_request\r\nDEBUG: Chef::HTTP calling Chef::HTTP::Authenticator#handle_request\r\nDEBUG: Signing the request as jaum\r\nDEBUG: Chef::HTTP calling Chef::HTTP::RemoteRequestID#handle_request\r\nDEBUG: Chef::HTTP calling Chef::HTTP::ValidateContentLength#handle_request\r\nDEBUG: Initiating GET to https://chef-host/organizations/organization/users/truta\r\nDEBUG: ---- HTTP Request Header Data: ----\r\nDEBUG: Accept: application/json\r\nDEBUG: Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3\r\nDEBUG: X-OPS-SIGN: algorithm=sha1;version=1.0;\r\nDEBUG: X-OPS-USERID: jaum\r\nDEBUG: X-OPS-TIMESTAMP: 2015-01-22T19:42:02Z\r\nDEBUG: X-OPS-CONTENT-HASH: 2jmj7l5rSw0yVb/vlWAYkK/YBwk=\r\nDEBUG: X-OPS-AUTHORIZATION-1: GsGVBloLX88PUr+OygGRf/JfqenGh2ZHvGS5LXEIehw/+Xu8Xgi5QYGK9lDs\r\nDEBUG: X-OPS-AUTHORIZATION-2: lQ6NGPt4AoiglpTuQUJnyP8rhPLEeNlMmh3hxBbGMlWHzTOqWsHvPLlbAg6e\r\nDEBUG: X-OPS-AUTHORIZATION-3: H7uWraSg882f26xXDkFJOhu/loBD3jZ51eCsyEJwJkkPhlOG8yVmNrgzn2cV\r\nDEBUG: X-OPS-AUTHORIZATION-4: sKvwKHJwAu5UUGHrNcyKeH1SPlWYHZFhL0lEMb6lwDxZA7O5nKJu9RE/nEPc\r\nDEBUG: X-OPS-AUTHORIZATION-5: FKYframg47s+uPYjrb9MjH5AjtAK3DBA1dZxXrTFTEeB2rtWNjrSAVNE0O5I\r\nDEBUG: X-OPS-AUTHORIZATION-6: GlqUUlBuXa0j/Er52tIMJBl0Fav4cwGK5tNx1DniNQ==\r\nDEBUG: HOST: chef-host:443\r\nDEBUG: X-REMOTE-REQUEST-ID: 1fb2cc5a-25a4-483a-b4e5-adaedb01d80a\r\nDEBUG: ---- End HTTP Request Header Data ----\r\nDEBUG: ---- HTTP Status and Header Data: ----\r\nDEBUG: HTTP 1.1 403 Forbidden\r\nDEBUG: server: ngx_openresty/1.4.3.6\r\nDEBUG: date: Thu, 22 Jan 2015 19:42:01 GMT\r\nDEBUG: content-length: 37\r\nDEBUG: connection: close\r\nDEBUG: x-ops-api-info: flavor=cs;version=12.0.0;oc_erchef=0.29.4\r\nDEBUG: ---- End HTTP Status/Header Data ----\r\nDEBUG: Chef::HTTP calling Chef::HTTP::ValidateContentLength#handle_response\r\nDEBUG: Content-Length validated correctly.\r\nDEBUG: Chef::HTTP calling Chef::HTTP::RemoteRequestID#handle_response\r\nDEBUG: Chef::HTTP calling Chef::HTTP::Authenticator#handle_response\r\nDEBUG: Chef::HTTP calling Chef::HTTP::Decompressor#handle_response\r\nDEBUG: Chef::HTTP calling Chef::HTTP::CookieManager#handle_response\r\nDEBUG: Chef::HTTP calling Chef::HTTP::JSONToModelOutput#handle_response\r\nDEBUG: Expected JSON response, but got content-type ''\r\nDEBUG: Chef::HTTP calling Chef::HTTP::JSONInput#handle_response\r\nINFO: HTTP Request Returned 403 Forbidden: error\r\n/opt/chefdk/embedded/lib/ruby/2.1.0/net/http/response.rb:119:in `error!': 403 \"Forbidden\" (Net::HTTPServerException)\r\n\tfrom /opt/chefdk/embedded/apps/chef/lib/chef/http.rb:145:in `request'\r\n\tfrom /opt/chefdk/embedded/apps/chef/lib/chef/rest.rb:115:in `get'\r\n\tfrom /opt/chefdk/embedded/apps/chef/lib/chef/user.rb:164:in `load'\r\n\tfrom /opt/chefdk/embedded/apps/chef/lib/chef/knife/user_show.rb:43:in `run'\r\n\tfrom /opt/chefdk/embedded/apps/chef/lib/chef/knife.rb:493:in `run_with_pretty_exceptions'\r\n\tfrom /opt/chefdk/embedded/apps/chef/lib/chef/knife.rb:174:in `run'\r\n\tfrom /opt/chefdk/embedded/apps/chef/lib/chef/application/knife.rb:139:in `run'\r\n\tfrom /opt/chefdk/embedded/apps/chef/bin/knife:25:in `<top (required)>'\r\n\tfrom /usr/bin/knife:33:in `load'\r\n\tfrom /usr/bin/knife:33:in `<main>'\r\n```\r\n\r\n\r\nThanks!!"}}