Bug 2148887
| Summary: | MemberManager with groups fails | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Florence Blanc-Renaud <frenaud> |
| Component: | ipa | Assignee: | Florence Blanc-Renaud <frenaud> |
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 9.2 | CC: | abokovoy, apeddire, frenaud, ftrivino, ipa-qe, mpolovka, myusuf, pasik, rcritten, sam, sigbjorn.lie, tscherf, yehuda |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-4.10.1-2.el9 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 2056009 | Environment: | |
| Last Closed: | 2023-05-09 07:33:20 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2056009 | ||
| Bug Blocks: | |||
|
Comment 1
Florence Blanc-Renaud
2022-11-28 17:54:46 UTC
Fixed upstream ipa-4-9: https://pagure.io/freeipa/c/651e28c1fb6b86ad1fbd4ea98644e00b7042499c version:
ipa-server-4.10.1-2.el9.x86_64
steps:
1. Install 7.9 server then migrate to rhel8.7. Make rhel8.7 server crl master server.
2. Added user and required groups
#ipa user-add idmuser
#ipa group-add role-groupmanager
#ipa group-add role-usergroup-A
#ipa group-add-member role-groupmanager --user idmuser
#ipa group-add-member-manager --groups role-groupmanager role-usergroup-A
3. kinit as idmuser and add a member to role-user-group-A
[root@replica87 ~]# ipa group-add-member --users admin role-usergroup-A
Group name: role-usergroup-a
GID: 143100003
Membership managed by groups: role-groupmanager
Failed members:
member user: admin: Insufficient access: Insufficient 'write' privilege to the 'member' attribute of entry 'cn=role-usergroup-a,cn=groups,cn=accounts,dc=testrelm,dc=test'.
member group:
member service:
member User ID override:
-------------------------
Number of members added 0
-------------------------
Add rhel9.2 replica against rhel87 server
[root@replica92 ~]# cat /usr/share/ipa/updates/20-aci.update | grep 'Allow member managers'
# Allow member managers to modify members of user groups
remove:aci: (targetattr = "member")(targetfilter = "(objectclass=ipaUserGroup)")(version 3.0; acl "Allow member managers to modify members of user groups"; allow (write) userattr = "memberManager#USERDN";)
add:aci: (targetattr = "member")(targetfilter = "(objectclass=ipaUserGroup)")(version 3.0; acl "Allow member managers to modify members of user groups"; allow (write) userattr = "memberManager#USERDN" or userattr = "memberManager#GROUPDN";)
# Allow member managers to modify members of host groups
remove:aci: (targetattr = "member")(targetfilter = "(objectclass=ipaHostGroup)")(version 3.0; acl "Allow member managers to modify members of host groups"; allow (write) userattr = "memberManager#USERDN";)
add:aci: (targetattr = "member")(targetfilter = "(objectclass=ipaHostGroup)")(version 3.0; acl "Allow member managers to modify members of host groups"; allow (write) userattr = "memberManager#USERDN" or userattr = "memberManager#GROUPDN";)
[root@replica92 ~]#
Now try same operation as in 3 on rhel87 server
[root@replica87 ~]# ipa group-add-member --users admin role-usergroup-A
Group name: role-usergroup-a
GID: 143100003
Member users: admin
Membership managed by groups: role-groupmanager
-------------------------
Number of members added 1
-------------------------
Based on above observations, marking the bug verified.
Test added upstream master: https://pagure.io/freeipa/c/4acd9fe9f7f0934ff26bbd6254c036341b1dae52 Test case: ipatests/test_integration/test_membermanager.py::TestMemberManager::test_member_manager_upgrade_scenario Test added upstream: ipa-4-10: https://pagure.io/freeipa/c/e1f4f655a65777f5096e65b8e5c3e079f77f6ecc ipa-4-9: https://pagure.io/freeipa/c/2fb6f0216e7433e0e6459678863edb2a31c90cde Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (ipa bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:2205 |