Bug 1782087
| Summary: | Removing an IPA sub-group should NOT remove the members from indirect parent that also belong to other subgroups | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Ding-Yi Chen <dchen> | ||||||
| Component: | sssd | Assignee: | Sumit Bose <sbose> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> | ||||||
| Severity: | high | Docs Contact: | |||||||
| Priority: | high | ||||||||
| Version: | 7.7 | CC: | atikhono, bthekkep, dlavu, grajaiya, ipa-qe, jhrozek, ksiddiqu, lslebodn, mzidek, ndehadra, pbrezina, rcritten, sbose, sgoveas, ssidhaye, thalman, tscherf, yoguma, yuriy.halytskyy | ||||||
| Target Milestone: | rc | Keywords: | Triaged, ZStream | ||||||
| Target Release: | --- | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | sync-to-jira | ||||||||
| Fixed In Version: | sssd-1.16.5-1.el7 | Doc Type: | If docs needed, set a value | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | |||||||||
| : | 1817374 1817375 1817376 1817377 1817379 1817380 (view as bug list) | Environment: | |||||||
| Last Closed: | 2020-09-29 19:49:11 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Bug Depends On: | |||||||||
| Bug Blocks: | 1788833, 1817374, 1817375, 1817376, 1817377, 1817379, 1817380 | ||||||||
| Attachments: |
|
||||||||
Any updates? Perhaps we can backport the fix in sssd-2.2.0 to RHEL 7 https://pagure.io/SSSD/sssd/c/1f5d139d103328b6e4be7dc8368abdd39a91d3a6.patch Issue: nested group missing after updates on provider https://pagure.io/SSSD/sssd/issue/3636 (In reply to Ding-Yi Chen from comment #3) > Perhaps we can backport the fix in sssd-2.2.0 to RHEL 7 > > > https://pagure.io/SSSD/sssd/c/1f5d139d103328b6e4be7dc8368abdd39a91d3a6.patch > > Issue: nested group missing after updates on provider > https://pagure.io/SSSD/sssd/issue/3636 Hi, thanks for the hint, shall I create a test-build for RHEL-7.7 with the backported fix to see if this fixes the issue for you/your customer? bye, Sumit (In reply to Sumit Bose from comment #4) > (In reply to Ding-Yi Chen from comment #3) > > Perhaps we can backport the fix in sssd-2.2.0 to RHEL 7 > > > > > > https://pagure.io/SSSD/sssd/c/1f5d139d103328b6e4be7dc8368abdd39a91d3a6.patch > > > > Issue: nested group missing after updates on provider > > https://pagure.io/SSSD/sssd/issue/3636 > > Hi, > > thanks for the hint, shall I create a test-build for RHEL-7.7 with the > backported fix to see if this fixes the issue for you/your customer? > > bye, > Sumit Yes please Created attachment 1656482 [details]
test build
Hi,
please find attached a tar ball with a test build of SSSD including the patch you've mentioned earlier.
bye,
Sumit
The test-build fixes my reproducer. Thanks Sumit. * `sssd-1-16`
* 9a7c044dcd17b23127ddda25ff9cddc9c67fe4ca - memberof: keep memberOf attribute for nested member
*** Bug 1789220 has been marked as a duplicate of this bug. *** Removing the needinfo on me as Sumedh taking care of it. ipa-group-cli regression run passing : http://idm-artifacts.usersys.redhat.com/ipa-prod-tier1/RHEL7.9/17/ipa-group-cli/ Created attachment 1697603 [details]
test automation run
test automation run junit
[root@ci-vm-10-0-139-68 freeipa]# ipa-run-tests test_integration/test_sssd.py::TestNestedMembers --junit-xml=/tmp/test_sssd.xml ============================================================== test session starts =============================================================== platform linux -- Python 3.6.8, pytest-3.4.2, py-1.5.4, pluggy-0.6.0 rootdir: /usr/lib/python3.6/site-packages/ipatests, inifile: plugins: sourceorder-0.5, multihost-3.0 collected 1 item test_integration/test_sssd.py . [100%] ----------------------------------------------------- generated xml file: /tmp/test_sssd.xml ----------------------------------------------------- =========================================================== 1 passed in 428.15 seconds =========================================================== master: [root@ci-vm-10-0-138-47 ~]# rpm -q ipa-server ipa-server-dns sssd ipa-server-4.6.8-4.el7.x86_64 ipa-server-dns-4.6.8-4.el7.noarch sssd-1.16.5-10.el7.x86_64 client: [root@ci-vm-10-0-139-166 ~]# rpm -q ipa-client sssd ipa-client-4.6.8-4.el7.x86_64 sssd-1.16.5-10.el7.x86_64 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (sssd bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:3904 |
Description of problem: In IPA, there are 3 groups: child1 and child2 are subgroups of parent, like the following parent | +- child1 (user1) | +- child2 (user1) user1 is an username, it belongs to both group child1 and child2. user1 should also belong to parent # getent group parent parent:*:12345:user1 # id user1 uid=1234(user1), gid=xxxx(user1), groups=xxxx(user1),xxxx(child1),xxxx(child2),xxxx(parent) However, after removed child1 from parent, user1 is no longer belong to parent # getent group parent parent:*:12345: # id user1 uid=1234(user1), gid=xxxx(user1), groups=xxxx(user1),xxxx(child1),xxxx(child2) Version-Release number of selected component (if applicable): sssd-1.16.4-21.el7.x86_64 How reproducible: Always Steps to Reproduce: 0. Setup kinit admin ipa user-add user1 ipa group-add child1 ipa group-add child2 ipa group-add parent ipa group-add-member parent --group child1 ipa group-add-member parent --group child2 ipa group-add-member child1 --user user1 ipa group-add-member child2 --user user1 # Verifying user1 is belong to parent id user1 getent group parent ipa user-show user1 1. Remove child1 from parent ipa group-remove-member parent --group child1 2. Check membership for user1 id user1 getent group parent ipa user-show user1 Actual results: id user1: do not have parent getent group parent: do not have user1 ipa user-show user1: have parent Expected results: id user1: have parent getent group parent: have user1 ipa user-show user1: have parent Additional info: sss_cashe -E does not fix the problem systemctl restart sssd does not fix the problem You need to remove cache file before starting sssd to reload the correct membership: systemctl stop sssd; rm -fr /var/lib/sss/db/*; systemctl start sssd