Bug 2234480
| Summary: | Allowing idp-user-id modification with ipa user-mod after removing idp | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Varun Mylaraiah <mvarun> | |
| Component: | ipa | Assignee: | Florence Blanc-Renaud <frenaud> | |
| Status: | CLOSED MIGRATED | QA Contact: | ipa-qe | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 8.9 | CC: | abokovoy, ftrivino, rcritten, tscherf | |
| Target Milestone: | rc | Keywords: | MigratedToJIRA, Triaged | |
| Target Release: | --- | |||
| Hardware: | x86_64 | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 2234481 (view as bug list) | Environment: | ||
| Last Closed: | 2023-09-18 23:12:05 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 2234481 | |||
1. IMO the part "Modify user without --idp attribute" should succeed: [root@master ~]# ipa user-mod idpuser1 --idp-user-id=new.mydomain2.test ipa: ERROR: attribute "ipaIdpSub" not allowed There is a function called on add/mod that is checking if some objectclasses are missing (check_object_class, https://github.com/freeipa/freeipa/blob/master/ipaserver/plugins/baseuser.py#L719). This function should add the objectclass ipaIdpUser to the user entry if the attribute ipaIdpSub is in the add/mod. 2. For better usability, we should add a warning when removing an idp if there are users linked to this idp. It could look like: # ipa idp-del MytestIdP WARNING: the idp 'MytestIdP' is referenced by users 'MyUserA', 'MyUserB', please update the users by removing their External IdP configuration. ----------------------------------------------- Deleted Identity Provider reference "MytestIdP" ----------------------------------------------- I am concerned with all these requests that effectively ask for a full-database scan of the connected entries. It is going to be problematic for several reasons as it is subject to the bound LDAP user's search and access limits. We might not be able to see all users which reference this IdP entry. The ipaidpconfiglink is DN is already handled by the referential integrity plugin. This means a removal of IdP definition means removal of that attribute from the user entry automatically. Perhaps referential integrity plugin could be extended to allow removal of associated attributes from the entry that references ipaidpconfiglink with the removed DN? Right now it cannot do that, it only removes that individual attribute from the affected entry. My bad, I understood that removing an IdP did not remove the idp reference in the user entry. Alexander clarified and indeed there is the referential integrity plugin that updates the user entry and removes the value "External IdP configuration: myidp" So for this BZ, I think we should fix the first part, i.e. automatically append the objectclass ipaIdpUser to the user entry if the attribute ipaIdpSub is in the add/mod. Upstream ticket: https://pagure.io/freeipa/issue/9433 Fixed upstream master: https://pagure.io/freeipa/c/0654fb3737febf3d9836cdd2a98352c34c447a6f Fixed upstream ipa-4-11: https://pagure.io/freeipa/c/f16b6e3e0a1f3dc507c3150c347276255f3b3e72 Fixed upstream ipa-4-10: https://pagure.io/freeipa/c/1b69b0ee2578b8e5cad6a47f37f46c509fddee42 Fixed upstream ipa-4-9: https://pagure.io/freeipa/c/7e5740f534893487f5a61907ebd6e3677f0beecc Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug. This BZ has been automatically migrated to the issues.redhat.com Red Hat Issue Tracker. All future work related to this report will be managed there. Due to differences in account names between systems, some fields were not replicated. Be sure to add yourself to Jira issue's "Watchers" field to continue receiving updates and add others to the "Need Info From" field to continue requesting information. To find the migrated issue, look in the "Links" section for a direct link to the new issue location. The issue key will have an icon of 2 footprints next to it, and begin with "RHEL-" followed by an integer. You can also find this issue by visiting https://issues.redhat.com/issues/?jql= and searching the "Bugzilla Bug" field for this BZ's number, e.g. a search like: "Bugzilla Bug" = 1234567 In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. You can also visit https://access.redhat.com/articles/7032570 for general account information. |
Description of problem: Allowing idp-user-id modification with ipa user-mod after removing idp. Version-Release number of selected component (if applicable): ipa-server-4.9.12-7 Steps to Reproduce: 1. Modify user without --idp attribute ==== ipa user-mod fails as expected (ipa user-mod idpuser1 --idp-user-id=new.mydomain2.test) 2. Modify user with --idp attribute (ipa user-mod idpuser1 --idp=MytestIdP --idp-user-id=new.mydomain2.test) 3. Remove idp from server (ipa idp-del MytestIdP) 4. Modify user without --idp attribute ==== ipa user-mod command succeed (ipa user-mod idpuser1 --idp-user-id=newtest.domain.test) Actual results: ipa user-mod (Step 4) succeeded after IDP removed Expected results: Step 4 should report the error. Additional info: [root@master ~]# ipa user-show idpuser1 User login: idpuser1 First name: useridp Last name: user Home directory: /home/idpuser1 Login shell: /bin/sh Principal name: idpuser1 Principal alias: idpuser1 Email address: idpuser1 UID: 1381800005 GID: 1381800005 Account disabled: False Password: False Member of groups: ipausers Kerberos keys available: False [root@master ~]# ipa idp-show MytestIdP Identity Provider reference name: MytestIdP Authorization URI: https://accounts.google.com/o/oauth2/auth Device authorization URI: https://oauth2.googleapis.com/device/code Token URI: https://oauth2.googleapis.com/token User info URI: https://openidconnect.googleapis.com/v1/userinfo JWKS URI: https://www.googleapis.com/oauth2/v3/certs Client identifier: i1qawe23 Scope: openid email External IdP user identifier attribute: email - 1. Modify user without --idp attribute ==== ipa user-mod fails as expected [root@master ~]# ipa user-mod idpuser1 --idp-user-id=new.mydomain2.test ipa: ERROR: attribute "ipaIdpSub" not allowed - 2. Modify user with --idp attribute [root@master ~]# ipa user-mod idpuser1 --idp=MytestIdP --idp-user-id=new.mydomain2.test ------------------------ Modified user "idpuser1" ------------------------ User login: idpuser1 First name: useridp Last name: user Home directory: /home/idpuser1 Login shell: /bin/sh Principal name: idpuser1 Principal alias: idpuser1 Email address: idpuser1 UID: 1381800005 GID: 1381800005 External IdP configuration: MytestIdP External IdP user identifier: new.mydomain2.test Account disabled: False Password: False Member of groups: ipausers Kerberos keys available: False - 3. Remove idp from server [root@master ~]# ipa idp-del MytestIdP ----------------------------------------------- Deleted Identity Provider reference "MytestIdP" ----------------------------------------------- - 4. Modify user without --idp attribute ==== ipa user-mod command succeed [root@master ~]# ipa user-mod idpuser1 --idp-user-id=newtest.domain.test ------------------------ Modified user "idpuser1" ------------------------ User login: idpuser1 First name: useridp Last name: user Home directory: /home/idpuser1 Login shell: /bin/sh Principal name: idpuser1 Principal alias: idpuser1 Email address: idpuser1 UID: 1381800005 GID: 1381800005 External IdP user identifier: newtest.domain.test Account disabled: False Password: False Member of groups: ipausers Kerberos keys available: False