Bug 785152

Summary:	[ipa webui] User with permission to update dnsrecord, cannot open it
Product:	Red Hat Enterprise Linux 6	Reporter:	Namita Soman <nsoman>
Component:	ipa	Assignee:	Rob Crittenden <rcritten>
Status:	CLOSED WORKSFORME	QA Contact:	IDM QE LIST <seceng-idm-qe-list>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.2	CC:	jgalipea, mkosek, pvoborni
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-03-20 14:07:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Namita Soman 2012-01-27 13:22:09 UTC

Description of problem:
Add a permission to allow a user to update a dns record's aRecord. Add a user to have this permission, and log in as this user.
To update the dnsrecord's aRecord, click on it to open it.
And you see:
Error: IPA Error 3007
'idnsname' is required

Using cli, can update record successfully.

Version-Release number of selected component (if applicable):
ipa-server-2.2.0-101.20120123T0157zgit64cf8a4.el6.x86_64

How reproducible:
always

Steps to Reproduce:
1.Add a permission:
# ipa permission-add ABC --permissions=write --subtree=idnsname=testrelm.com,cn=dns,dc=testrelm,dc=com --attr=nSRecord,aRecord,idnsZoneActive

2. Add a privilege, a role, a user, and assign the role to this user
3. kinit as this user
4. Go to DNSZones - testrelm.com - ipaqavmf (or similar path depending on test env) 
  
Actual results:
Error: IPA Error 3007
'idnsname' is required


Expected results:
To be able to open this record, and update its aRecord

Additional info:
Using CLI can do the above.
1> dnsrecord for ipaqavmf is as below:
# ipa dnsrecord-show --all --raw
Zone name: testrelm.com
Record name: ipaqavmf
  dn: idnsname=ipaqavmf,idnsname=testrelm.com,cn=dns,dc=testrelm,dc=com
  idnsname: ipaqavmf
  arecord: 10.16.98.191
  objectclass: top
  objectclass: idnsrecord

2> update its aRecord (this user has permission to do so):
# ipa dnsrecord-mod --setattr="aRecord=10.16.98.192"
Zone name: testrelm.com
Record name: ipaqavmf
  Record name: ipaqavmf
  A record: 10.16.98.192

3> update its idnsname (this user does not have permission to do so):
# ipa dnsrecord-mod --setattr="idnsname=ipaqb"
Zone name: testrelm.com
Record name: ipaqavmf
ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the 'idnsName' attribute of entry 'idnsname=ipaqavmf,idnsname=testrelm.com,cn=dns,dc=testrelm,dc=com'.

Comment 1 Martin Kosek 2012-01-30 08:03:54 UTC

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/2319

Comment 2 Petr Vobornik 2012-03-08 13:58:21 UTC

Works for me (ipa-2-2). 

But error
{{{
Error: IPA Error 3007
'idnsname' is required
}}}

Is a general UI error which sometimes occur. It most likely doesn't have any connection with permissions. It's exact cause is not yet determined and I didn't encounter it for quite a while (maybe it got self-fixed). 

Do you have exact steps how to reproduce it?  'Go to DNSZones - testrelm.com - ipaqavmf (or similar path depending on test
env)' is vague. Is it by direct link or, clicking throw UI? Was it automated or manual? (timings).

Comment 3 Petr Vobornik 2012-03-19 12:09:17 UTC

I'll just add that Error 3007 means that we didn't send a required parameter for command. The question is "Why? resp. "When?".

If it is really always reproducible I would like to know more details of step #4 (as said in previous comment).

Comment 4 Namita Soman 2012-03-20 14:07:42 UTC

Tried this on ipa-server-2.2.0-3.el6.x86_64, and cannot reproduce it.

Comment 5 Namita Soman 2012-04-12 19:52:52 UTC

The behaviour changed with the fix available for bug 807361. The new permission also has to be provided in spite of the one used in example above to list zones. But either way - the error is not displayed.