| Summary: | Unable to use privilege-remove-permission to remove a permission assigned to a provided privilege | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Namita Soman <nsoman> |
| Component: | ipa | Assignee: | Rob Crittenden <rcritten> |
| Status: | CLOSED WORKSFORME | QA Contact: | IDM QE LIST <seceng-idm-qe-list> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.2 | CC: | mkosek |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-04-30 15:13:42 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
Upstream ticket: https://fedorahosted.org/freeipa/ticket/2497 Not seeing the issue anymore using - ipa-server-2.2.0-11.el6.x86_64 # ipa privilege-remove-permission --permissions="Add HBAC services" "HBAC Administrator" Privilege name: HBAC Administrator Description: HBAC Administrator Permissions: Delete HBAC rule, Modify HBAC rule, Manage HBAC rule membership, Delete HBAC services, Add HBAC service groups, Delete HBAC service groups, Manage HBAC service group membership Granting privilege to roles: IT Security Specialist ------------------------------- Number of permissions removed 1 ------------------------------- |
Description of problem: Using ipa privilege-remove-permission to remove permissions from the privileges provided - throws an error that it is not a member of the privilege. But doing the same on privileges added by user is successful. 1> Remove the permission "add hbac rule" from privilege "HBAC Administrator" # ipa privilege-remove-permission --permissions="add hbac rule" "HBAC Administrator" Privilege name: HBAC Administrator Description: HBAC Administrator Permissions: add hbac rule, delete hbac rule, modify hbac rule, manage hbac rule membership, add hbac services, delete hbac services, add hbac service groups, delete hbac service groups, manage hbac service group membership Granting privilege to roles: IT Security Specialist Failed members: permission: add hbac rule: This entry is not a member ------------------------------- Number of permissions removed 0 ------------------------------- 2> The error indicates this permission is not available for privilege, so then attempt to add the permission to privilege "HBAC Administrator" # ipa privilege-add-permission --permissions="add hbac rule" "HBAC Administrator" Privilege name: HBAC Administrator Description: HBAC Administrator Permissions: add hbac rule, delete hbac rule, modify hbac rule, manage hbac rule membership, add hbac services, delete hbac services, add hbac service groups, delete hbac service groups, manage hbac service group membership Granting privilege to roles: IT Security Specialist Failed members: permission: add hbac rule: Type or value exists: ----------------------------- Number of permissions added 0 ----------------------------- This is the behaviour with all the privileges provided by IPA. But for a privilege added by user, to which a permission is added, this is not the case: 1> Add a privilege # ipa privilege-add "Test" --desc="Test" ---------------------- Added privilege "Test" ---------------------- Privilege name: Test Description: Test 2> Add a permission to this privilege # ipa privilege-add-permission --permissions="add hbac rule" "Test" Privilege name: Test Description: Test Permissions: add hbac rule ----------------------------- Number of permissions added 1 ----------------------------- 3> Remove this permission for this privilege # ipa privilege-remove-permission --permissions="add hbac rule" "Test" Privilege name: Test Description: Test ------------------------------- Number of permissions removed 1 ------------------------------- Version-Release number of selected component (if applicable): ipa-server-2.2.0-102.20120222T1126zgit64dd82f.el6.x86_64 How reproducible: always Steps to Reproduce: 1. Remove a permission from a IPA provided privilege (see more detailed steps above) Actual results: Throws an error - This entry is not a member Expected results: Be able to remove the permission from the privilege Additional info: