Bug 1246136

Summary: Adding a privilege to a permission avoids validation
Product: Red Hat Enterprise Linux 7 Reporter: Jan Cholasta <jcholast>
Component: ipaAssignee: IPA Maintainers <ipa-maint>
Status: CLOSED ERRATA QA Contact: Namita Soman <nsoman>
Severity: unspecified Docs Contact:
Priority: medium    
Version: 7.2CC: akasurde, mkosek, rcritten
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: ipa-4.2.0-3.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-11-19 12:04:35 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jan Cholasta 2015-07-23 14:13:31 UTC 
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/5075

If you try to add a permission with a bindtype of all to a privilege you'll (correctly) get an error:

{{{
$ ipa privilege-add-permission --permissions "System: Read HBAC Rules" "HBAC Administrator"
ipa: ERROR: invalid 'permission': cannot add permission "System: Read HBAC Rules" with bindtype "all" to a privilege
}}}

You can work around this in the UI by going into RBAC -> Permissions -> "Sstem: Read HBAC Rules" and select privileges and add it to "HBAC Administrator" that way. It will succeed.

It does so because it uses the non-CLI command permission_add_member which doesn't include the bindtype test.
Comment 1 Jan Cholasta 2015-07-23 14:14:38 UTC 
Fixed upstream
master:
https://fedorahosted.org/freeipa/changeset/a619a1e211927c27f5c034dec8c1a1bbc03720f2/
ipa-4-2:
https://fedorahosted.org/freeipa/changeset/652eb08672e3db5fb7f9ac00914643177c74e631/
Comment 3 Abhijeet Kasurde 2015-09-08 11:07:46 UTC 
Verified fix related to RBAC validation using IPA Web UI. 

IPA version : ipa-server-4.2.0-8.el7.x86_64

Marking as verified.
Comment 4 errata-xmlrpc 2015-11-19 12:04:35 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2362.html