Bug 809560

Summary: Do not create private groups for migrated users
Product: Red Hat Enterprise Linux 6 Reporter: Dmitri Pal <dpal>
Component: ipaAssignee: Rob Crittenden <rcritten>
Status: CLOSED ERRATA QA Contact: IDM QE LIST <seceng-idm-qe-list>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.3CC: jgalipea, mkosek
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: ipa-2.2.0-8.el6 Doc Type: Bug Fix
Doc Text:
No documentation needed.
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-06-20 13:26:31 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Dmitri Pal 2012-04-03 16:23:41 UTC
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/2604

User private groups should not be created for migrated posix users, their GID points to another group:

{{{
# echo "secret123" | ipa migrate-ds ldap://vm-054.idm.lab.bos.redhat.com --with-compat --base-dn="dc=greyoak,dc=com"
-----------
migrate-ds:
-----------
Migrated:
  user: darcee_leeson, ayaz_kreiger, mollee_weisenberg
  group: ipagroup
Failed user:
Failed group:
----------
Passwords have been migrated in pre-hashed format.
IPA is unable to generate Kerberos keys unless provided
with clear text passwords. All migrated users need to
login at https://your.domain/ipa/migration/ before they
can use their Kerberos accounts.

# ipa user-show darcee_leeson
  User login: darcee_leeson
  First name: Darcee
  Last name: Leeson
  Home directory: /home/Darcee_Leeson
  Email address: Darcee_Leeson
  UID: 11731
  GID: 21731         <<<<<<<<<
  Telephone Number: +1 804 913-8558
  Org. Unit: Product Testing
  Job Title: Supreme Product Testing Visionary
  Account disabled: False
  Password: True
  Member of groups: ipausers
  Kerberos keys available: False
# ipa group-show darcee_leeson
  Group name: darcee_leeson
  Description: User private group for darcee_leeson
  GID: 11731        <<<<<<<<<
}}}

Comment 1 Rob Crittenden 2012-04-04 15:35:28 UTC
fixed upstream.

master: b55c98f1c5b0d46aba3f1792ebd8ecc059173b6a

ipa-2-2: b98342ae6e60920c88e0979a84705874d59a0f3d

Comment 4 Jenny Severance 2012-04-23 15:24:51 UTC
verified ::

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: bz809560 Do not create private groups for migrated users
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: Verify user 'puser1' does not have a private group
:: [   PASS   ] :: Verify user 'puser2' does not have a private group
:: [   PASS   ] :: Verify user 'philomena_hazen' does not have a private group
:: [   LOG    ] :: Duration: 7s
:: [   LOG    ] :: Assertions: 3 good, 0 bad
:: [   PASS   ] :: RESULT: bz809560 Do not create private groups for migrated users


version :: ipa-server-2.2.0-10.el6.x86_64

Comment 6 Martin Kosek 2012-04-25 11:24:28 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
No documentation needed.

Comment 8 errata-xmlrpc 2012-06-20 13:26:31 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0819.html