URL:
https://github.com/freeipa/freeipa/pull/814
Title: #814: Add new permission to grant 'add' on cas container
frasertweedale commented:
"""
This problem is actually caused by a bug in a preliminary permission check during
`ca_add.pre_callback`, not an ACI issue. I am looking into it, but this is not the
solution, so I am NACKing it.
"""
See the full comment at
https://github.com/freeipa/freeipa/pull/814#issuecomment-305072773