Red Hat Bugzilla – Bug 1321884
IPA sudo: support the externalUser attribute
Last modified: 2017-03-21 05:55:15 EDT
This bug is created as a clone of upstream ticket: https://fedorahosted.org/sssd/ticket/2972 The LDAP sudo provider supported the externalUser, the IPA one should too
* master: 991c9f47fcb24704b880f60ab8ee77cfda056e2c * sssd-1-13: d4d2ffa6cf967231ae725973ee2665dbd0e2391b
Ack to the doc text.
Failed to add sudorule with --externaluser option: [root@vm-idm-030 ~]# rpm -q sssd ipa-server sssd-1.14.0-43.el7.x86_64 ipa-server-4.4.0-12.el7.x86_64 [root@vm-idm-030 ~]# ipa sudorule-add --help|grep externaluser --externaluser=STR External User the rule applies to (sudorule-find only) --runasexternaluser=STR [root@vm-idm-030 ~]# ipa sudorule-add testrule --externaluser=test@domain.com ipa: ERROR: invalid 'externaluser': this option has been deprecated. [root@vm-idm-030 ~]# ipa sudorule-add testrule --runasexternaluser=test@domain.com ipa: ERROR: invalid 'runasexternaluser': this option has been deprecated.
(In reply to Xiyang Dong from comment #9) > Failed to add sudorule with --externaluser option: > [root@vm-idm-030 ~]# rpm -q sssd ipa-server > sssd-1.14.0-43.el7.x86_64 > ipa-server-4.4.0-12.el7.x86_64 > > [root@vm-idm-030 ~]# ipa sudorule-add --help|grep externaluser > --externaluser=STR External User the rule applies to (sudorule-find > only) > --runasexternaluser=STR > [root@vm-idm-030 ~]# ipa sudorule-add testrule --externaluser=test@domain.com > ipa: ERROR: invalid 'externaluser': this option has been deprecated. > [root@vm-idm-030 ~]# ipa sudorule-add testrule > --runasexternaluser=test@domain.com > ipa: ERROR: invalid 'runasexternaluser': this option has been deprecated. Just for your information. These steps does not test sssd. and this bug is about sssd. May I know why the state is "FailedQA"?
Hi Lukas, as what's in bug description "The LDAP sudo provider supported the externalUser, the IPA one should too" I agree with you that the component should be changed to ipa.
(In reply to Xiyang Dong from comment #9) > Failed to add sudorule with --externaluser option: > [root@vm-idm-030 ~]# rpm -q sssd ipa-server > sssd-1.14.0-43.el7.x86_64 > ipa-server-4.4.0-12.el7.x86_64 > > [root@vm-idm-030 ~]# ipa sudorule-add --help|grep externaluser > --externaluser=STR External User the rule applies to (sudorule-find > only) > --runasexternaluser=STR > [root@vm-idm-030 ~]# ipa sudorule-add testrule --externaluser=test@domain.com > ipa: ERROR: invalid 'externaluser': this option has been deprecated. > [root@vm-idm-030 ~]# ipa sudorule-add testrule > --runasexternaluser=test@domain.com > ipa: ERROR: invalid 'runasexternaluser': this option has been deprecated. Well, this is not really relevant because customers might have this option set from a previous version. That's why the fix is in SSSD..the change we did in 6.8 to support the native LDAP IPA tree removed the support for the externalUser, this change is adding the support back.
btw if you'd like to set the attribute with a recent IPA version, you can use --setattr or --addattr
Jakub, how exactly can I verify this bugzilla?
Redirecting to Pavel, but I think the crux is to set the externalUser attribute with --setattr, thus simulating the old version where externalUser was still present.
I tried but it still says the same thing: [root@vm-idm-004 ~]# rpm -q sssd ipa-client sssd-1.13.3-45.el6.x86_64 ipa-client-3.0.0-51.el6.x86_64 [root@vm-idm-004 ~]# ipa sudorule-add testrule --setattr externaluser=test@domain.com ipa: ERROR: invalid 'externaluser': this option has been deprecated.
It may be not reproducible with recent IPA versions. I'm CCing Petr Vobornik from IPA to get the answer. Petr, how does one set the externalUser attribute on sudo object?
Just an idea. does externalUser attribute on sudo object work with ipa on rhel6?
On RHEL 7: In short, use the same command as for IPA user: $ ipa sudorule-show dsfdsf Rule name: dsfdsf Enabled: TRUE External User: aa, bb $ ipa sudorule-mod dsfdsf --externaluser=cc ipa: ERROR: invalid 'externaluser': this option has been deprecated. $ ipa sudorule-add-user dsfdsf --users=cc Rule name: dsfdsf Enabled: TRUE External User: aa, bb, cc ------------------------- Number of members added 1 -------------------------
Hi Xiyang, please let us know if Petr's comment helped.
Hi Jakub , what Petr mentioned works on RHEL6.9, so this is the way we support external users for now and I should verify the bug like this ? I mean this --externaluser attr is deprecated.It's a little confusing to me.
(In reply to Xiyang Dong from comment #23) > Hi Jakub , what Petr mentioned works on RHEL6.9, so this is the way we > support external users for now and I should verify the bug like this ? > I mean this --externaluser attr is deprecated.It's a little confusing to me. That's a decision the IPA UI developers took. The intent of this bug is to bring back the support for configurations set up this way by SSSD.
Thanks. Verified on sssd-1.13.3-48.el6: [root@nightcrawler ~]# cat /etc/sssd/sssd.conf | grep sudo_provider sudo_provider = ipa [root@nightcrawler ~]# service sssd restart Stopping sssd: [ OK ] Starting sssd: [ OK ] [root@nightcrawler ~]# ipa user-add testuser First name: testuser Last name: testuser --------------------- Added user "testuser" --------------------- User login: testuser First name: testuser Last name: testuser Full name: testuser testuser Display name: testuser testuser Initials: tt Home directory: /home/testuser GECOS field: testuser testuser Login shell: /bin/sh Kerberos principal: testuser@TESTRELM.TEST Email address: testuser@testrelm.test UID: 955600001 GID: 955600001 Password: False Kerberos keys available: False [root@nightcrawler ~]# ipa user-find aa --------------- 0 users matched --------------- ---------------------------- Number of entries returned 0 ---------------------------- [root@nightcrawler ~]# ipa sudorule-add test ---------------------- Added Sudo Rule "test" ---------------------- Rule name: test [root@nightcrawler ~]# ipa sudorule-add-user test --users=testuser,aa Rule name: test Enabled: TRUE Users: testuser External User: aa ------------------------- Number of members added 2 ------------------------- Enabled: TRUE
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2017-0632.html