Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
Hi, this is very simple bug to reproduce and fix.
externalhost: A
non fully qualified in a netgroup
ipa host-add A.DOMAIN
if I do:
ipa netgroup-remove-member mynetgroup
[member host]: A
if will fail because as it's finding the host under "cn=cmnputers", the command line will try to remove the host instead of the externalhost attibute.
See the details below.
Version-Release number of selected component (if applicable):
ipa-server-4.2.0-15.el7.x86_64
Steps to Reproduce:
[root@dell-r530-10 ~]# ipa netgroup-show mynetgroup --raw --all
dn: ipaUniqueID=e4b744ec-95c8-11e6-a92f-1866da5af007,cn=ng,cn=alt,dc=testrelm,dc=test
cn: mynetgroup
nisdomainname: testrelm.test
externalhost: mynode
ipaUniqueID: e4b744ec-95c8-11e6-a92f-1866da5af007
objectClass: ipaassociation
objectClass: ipaobject
objectClass: ipanisnetgroup
external host called mynode
+ host added with the same name:
ipa host-add mynode.testrealm.test --force
----------------------------------
Added host "mynode.testrealm.test"
----------------------------------
Host name: mynode.testrealm.test
Principal name: host/mynode.testrealm.test
Password: False
Keytab: False
Managed by: mynode.testrealm.test
ipa host-show mynode --raw --all
dn: fqdn=mynode.testrealm.test,cn=computers,cn=accounts,dc=testrelm,dc=test
fqdn: mynode.testrealm.test
krbprincipalname: host/mynode.testrealm.test
has_password: FALSE
has_keytab: FALSE
managedby: fqdn=mynode.testrealm.test,cn=computers,cn=accounts,dc=testrelm,dc=test
cn: mynode.testrealm.test
ipaUniqueID: 6fa5b3e4-95ca-11e6-9c7a-1866da5af007
managing: fqdn=mynode.testrealm.test,cn=computers,cn=accounts,dc=testrelm,dc=test
objectClass: ipaobject
objectClass: ieee802device
objectClass: nshost
objectClass: ipaservice
objectClass: pkiuser
objectClass: ipahost
objectClass: krbprincipal
objectClass: krbprincipalaux
objectClass: ipasshhost
objectClass: top
objectClass: ipaSshGroupOfPubKeys
serverHostName: mynode
[root@dell-r530-10 ~]#
Now, there's no way to delete the externalhost:
[root@dell-r530-10 ~]# ipa netgroup-remove-member mynetgroup
[member user]:
[member group]:
[member host]: mynode
[member host group]:
[member netgroup]:
Netgroup name: mynetgroup
NIS domain name: testrelm.test
External host: mynode
Failed hosts/hostgroups:
member host: mynode.testrealm.test: This entry is not a member
member host group:
---------------------------
Number of members removed 0
---------------------------
what we see is that the client application searches if there's a host already called mynode:
[19/Oct/2016:12:47:44 +051800] conn=40 op=7 SRCH base="cn=computers,cn=accounts,dc=testrelm,dc=test" scope=2 filter="(&(&(objectClass=ipaobject)(objectClass=nshost)(objectClass=ipahost)(objectClass=pkiuser)(objectClass=ipaservice))(serverHostName=mynode))" attrs=""
[19/Oct/2016:12:47:44 +051800] conn=40 op=7 RESULT err=0 tag=101 nentries=1 etime=0
So, it will try to apply the MOD operation on a "host" attribute and not an externalhost and it will fail:
[19/Oct/2016:12:47:44 +051800] conn=40 op=10 MOD dn="ipaUniqueID=e4b744ec-95c8-11e6-a92f-1866da5af007,cn=ng,cn=alt,dc=testrelm,dc=test"
[19/Oct/2016:12:47:44 +051800] conn=40 op=10 RESULT err=16 tag=103 nentries=0 etime=0 csn=58071e19000200040000
err=16 ===> LDAP_NO_SUCH_ATTRIBUTE
Workaround is very simple:
ldapmodify -D "cn=directory manager" -w Secret123
dn: ipaUniqueID=e4b744ec-95c8-11e6-a92f-1866da5af007,cn=ng,cn=alt,dc=testrelm,dc=test
changetype: modify
delete: externalhost
externalhost: mynode
Description of problem: Hi, this is very simple bug to reproduce and fix. externalhost: A non fully qualified in a netgroup ipa host-add A.DOMAIN if I do: ipa netgroup-remove-member mynetgroup [member host]: A if will fail because as it's finding the host under "cn=cmnputers", the command line will try to remove the host instead of the externalhost attibute. See the details below. Version-Release number of selected component (if applicable): ipa-server-4.2.0-15.el7.x86_64 Steps to Reproduce: [root@dell-r530-10 ~]# ipa netgroup-show mynetgroup --raw --all dn: ipaUniqueID=e4b744ec-95c8-11e6-a92f-1866da5af007,cn=ng,cn=alt,dc=testrelm,dc=test cn: mynetgroup nisdomainname: testrelm.test externalhost: mynode ipaUniqueID: e4b744ec-95c8-11e6-a92f-1866da5af007 objectClass: ipaassociation objectClass: ipaobject objectClass: ipanisnetgroup external host called mynode + host added with the same name: ipa host-add mynode.testrealm.test --force ---------------------------------- Added host "mynode.testrealm.test" ---------------------------------- Host name: mynode.testrealm.test Principal name: host/mynode.testrealm.test Password: False Keytab: False Managed by: mynode.testrealm.test ipa host-show mynode --raw --all dn: fqdn=mynode.testrealm.test,cn=computers,cn=accounts,dc=testrelm,dc=test fqdn: mynode.testrealm.test krbprincipalname: host/mynode.testrealm.test has_password: FALSE has_keytab: FALSE managedby: fqdn=mynode.testrealm.test,cn=computers,cn=accounts,dc=testrelm,dc=test cn: mynode.testrealm.test ipaUniqueID: 6fa5b3e4-95ca-11e6-9c7a-1866da5af007 managing: fqdn=mynode.testrealm.test,cn=computers,cn=accounts,dc=testrelm,dc=test objectClass: ipaobject objectClass: ieee802device objectClass: nshost objectClass: ipaservice objectClass: pkiuser objectClass: ipahost objectClass: krbprincipal objectClass: krbprincipalaux objectClass: ipasshhost objectClass: top objectClass: ipaSshGroupOfPubKeys serverHostName: mynode [root@dell-r530-10 ~]# Now, there's no way to delete the externalhost: [root@dell-r530-10 ~]# ipa netgroup-remove-member mynetgroup [member user]: [member group]: [member host]: mynode [member host group]: [member netgroup]: Netgroup name: mynetgroup NIS domain name: testrelm.test External host: mynode Failed hosts/hostgroups: member host: mynode.testrealm.test: This entry is not a member member host group: --------------------------- Number of members removed 0 --------------------------- what we see is that the client application searches if there's a host already called mynode: [19/Oct/2016:12:47:44 +051800] conn=40 op=7 SRCH base="cn=computers,cn=accounts,dc=testrelm,dc=test" scope=2 filter="(&(&(objectClass=ipaobject)(objectClass=nshost)(objectClass=ipahost)(objectClass=pkiuser)(objectClass=ipaservice))(serverHostName=mynode))" attrs="" [19/Oct/2016:12:47:44 +051800] conn=40 op=7 RESULT err=0 tag=101 nentries=1 etime=0 So, it will try to apply the MOD operation on a "host" attribute and not an externalhost and it will fail: [19/Oct/2016:12:47:44 +051800] conn=40 op=10 MOD dn="ipaUniqueID=e4b744ec-95c8-11e6-a92f-1866da5af007,cn=ng,cn=alt,dc=testrelm,dc=test" [19/Oct/2016:12:47:44 +051800] conn=40 op=10 RESULT err=16 tag=103 nentries=0 etime=0 csn=58071e19000200040000 err=16 ===> LDAP_NO_SUCH_ATTRIBUTE Workaround is very simple: ldapmodify -D "cn=directory manager" -w Secret123 dn: ipaUniqueID=e4b744ec-95c8-11e6-a92f-1866da5af007,cn=ng,cn=alt,dc=testrelm,dc=test changetype: modify delete: externalhost externalhost: mynode