Bug 1293538
| Summary: | [RFE] Netgroup LDAP Authentication with Satellite 6. | ||
|---|---|---|---|
| Product: | Red Hat Satellite | Reporter: | Ashfaqur Rahaman <arahaman> |
| Component: | Users & Roles | Assignee: | Tomas Strachota <tstrachota> |
| Status: | CLOSED ERRATA | QA Contact: | Sanket Jagtap <sjagtap> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 6.1.1 | CC: | ajoseph, aperotti, bbuckingham, bkearney, daniele, dcaplan, egolov, ehelms, jcallaha, jyejare, mhulan, mmccune, prsharma, sjagtap, suprabhu, tlestach, tstrachota, zhunting |
| Target Milestone: | Unspecified | Keywords: | FutureFeature, PrioBumpField, PrioBumpPM, Triaged |
| Target Release: | Unused | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-02-21 12:33:41 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1353215, 1479962, 1492835 | ||
|
Description
Ashfaqur Rahaman
2015-12-22 05:22:20 UTC
Moving 6.2 bugs out to sat-backlog. Moving 6.2 bugs out to sat-backlog. Netgroup grouping is alternative to posix usergroups. It works differently, they are to be found at ou=Netgroup,dc=example,dc=com tree with cn as their name. For association with user, attribute nisNetgroupTriple is defined in this object. Attribute is defined multiple times for each user in a given netgroup. The structure is triple ($server, $user, $domain). While users can set group base DN today, we hardcode "memberuid" that we use for searching posix groups. We could make this also configurable per LDAP auth source and let ldap_fluff search in this triple. I'm cancelling the need info as it's not clear what was asked. Created redmine issue http://projects.theforeman.org/issues/16112 from this bug Upstream bug assigned to tstrachota Hello, Any update on this bug ? Moving this bug to POST for triage into Satellite 6 since the upstream issue http://projects.theforeman.org/issues/16112 has been resolved. Build:Satellite 6.3.0 snap33 I am unable to associate external netgroup to user groups in Satellite Unable to save Could not refresh external usergroups: NoMethodError - undefined method `nisnetgrouptriple' for #<Net::LDAP::Entry:0x007fde55144638> - The netgroup is created in IPA [root@qe-sat6-ipa ~]# ipa netgroup-show netgroup1 Netgroup name: netgroup1 NIS domain name: <domain> Member User: netgroup_user Member Host: qe-sat6-feature-rhel6.<domain> [root@qe-sat6-ipa ~]# ldapsearch -LLL -x -b 'cn=netgroup1,cn=ng,cn=compat,dc=satqe,dc=lab,dc=eng,dc=rdu2,dc=redhat,dc=com' dn: cn=netgroup1,cn=ng,cn=compat,<domain> objectClass: nisNetgroup objectClass: top nisNetgroupTriple: (qe-sat6-feature-rhel6.<domain>,netgro up_user,<domain>) cn: netgroup1 Update: Even when there is error on submitting the usergroup with external netgroup.
The netgroup is associated with usergroup
On trying to login into satellite using netgroup user. The user doesn't inherit permissions roles from user group.
Id: 5
Login: netgroup_user
Name: foreman_proxy user
Email: netgroup_user@<domain>
Admin: no
Last login: 2018/01/23 08:11:58
Authorized by: IDM
Effective admin: no
Locale: default
Timezone: default
Description:
Default organization:
Default location:
Roles:
User groups:
Inherited User groups:
Locations:
Default Location
Organizations:
Default Organization
Created at: 2018/01/23 08:11:57
Updated at: 2018/01/23 08:11:57
Sanket, could you share the backtrace from the server logs when this error occurs, please? Thanks mhulan, once again
Looks like I had wrong groupDn configured. On updating the correct groupdn I was able to a associate the netgroup successfully
Also, the netgroup inherted the user group
[root@qe-capsule-feature-rhel6 ~]# hammer user info --id 7
Id: 7
Login: netgroup_user
Name: foreman_proxy user
Email: netgroup_user@<domain>
Admin: no
Last login: 2018/01/23 12:19:39
Authorized by: IDM
Effective admin: no
Locale: default
Timezone: default
Description:
Default organization:
Default location:
Roles:
User groups:
1) Usergroup: idm
Roles:
Create ARF report
Compliance viewer
Compliance manager
Inherited User groups:
Locations:
Default Location
Organizations:
Default Organization
Created at: 2018/01/23 12:19:39
Updated at: 2018/01/23 12:19:39
I'm glad it got resolved. It seems like we should file a new BZ about how we report such configuration errors. A message with some hint would be more useful. Sanket, since you know what was configured wrong, may I ask you to file one? Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2018:0336 |