RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1577967 - Users with user creation/modification privileges fail to add the "--radius-username" option when creating users
Summary: Users with user creation/modification privileges fail to add the "--radius-us...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.5
Hardware: All
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: ipa-qe
URL:
Whiteboard:
Depends On:
Blocks: 1647919
TreeView+ depends on / blocked
 
Reported: 2018-05-14 14:13 UTC by aheverle
Modified: 2022-03-13 14:59 UTC (History)
10 users (show)

Fixed In Version: ipa-4.6.5-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-08-06 13:09:05 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 3444051 0 None None None 2018-05-15 14:16:26 UTC
Red Hat Product Errata RHBA-2019:2241 0 None None None 2019-08-06 13:09:20 UTC

Description aheverle 2018-05-14 14:13:56 UTC 
Description of problem:
Customer has created a role for users to be able to create/modify users and groups.

When creating a user, they are not able to add the option "--radius-username".

How reproducible:
Everytime

Steps to Reproduce:
1. ipa user-add --first="test" --last="1234" --user-auth-type=radius --radius-username=testradius --uid=1745050526 --gidnumber=1745050526 test123


Actual results:
ipa: ERROR: attribute "ipatokenRadiusUserName" not allowed

Expected results:
Added user "test123"
Comment 2 Martin Kosek 2018-05-15 14:18:50 UTC 
I think that all this is about is adding ipatokenRadiusUserName to "System: Modify Users" permission.

That could be also used as a workaround - adding that attribute to the system permission via permission-mod command.
Comment 3 Florence Blanc-Renaud 2018-05-24 15:51:59 UTC 
Hi,

the command fails because it does not add the auxiliary objectclass ipatokenradiusproxyuser to the user entry. The addition of this object class is done only when ipa user-add/user-mod is called with --radius=<radius proxy configuration>.

There is also another issue, though. When the command is called with --radius=<radius proxy configuration>, it first ensures that the provided radius proxy exists, and a non-admin user will not have the ACIs to read 
cn=radiusproxy,$BASEDN, resulting in the check not finding the radius proxy and the operation to fail.

We can create a system permission for adding/reading the radius proxy entries or leave it up to the customer.
Comment 4 Florence Blanc-Renaud 2018-05-30 07:33:42 UTC 
Upstream ticket:
https://pagure.io/freeipa/issue/7569
Comment 5 Florence Blanc-Renaud 2018-05-30 07:54:47 UTC 
Upstream ticket for the roles/privileges/permissions:
https://pagure.io/freeipa/issue/7570
Comment 10 Florence Blanc-Renaud 2018-09-11 10:08:35 UTC 
Workaround:
===========

1. Create a user $USERNAME with "User Administrator" role:
kinit admin
ipa user-add $USERNAME --first=first --last=last --password
ipa role-add-member "User Administrator" --users=$USERNAME

2. Create permission, privilege and role allowing to read Radius Servers:
ipa permission-add "Read Radius Servers" --right read --right search --right compare --attrs objectclass --attrs cn --attrs ipatokenRadiusServer --bindtype permission  --subtree cn=radiusproxy,$BASEDN --filter="(objectclass=ipatokenradiusconfiguration)"
ipa privilege-add "Radius Proxy Readers Priv"
ipa privilege-add-permission "Radius Proxy Readers Priv" --permission "Read Radius Servers"
ipa role-add "Radius Proxy Reader Role"
ipa role-add-privilege "Radius Proxy Reader Role" --privileges "Radius Proxy Readers Priv"

3. Grant the above role to the user:
ipa role-add-member "Radius Proxy Reader Role" --users=$USERNAME

4. Add a Radius proxy server:
ipa radiusproxy-add myradiusproxy --server radius.example.com --secret

5. As $USERNAME, create a user with --radiususername:
kinit $USERNAME
ipa user-add --first="test" --last="1234" --user-auth-type=radius --radius-username=testradius --uid=1745050526 --gidnumber=1745050526 test123 --radius myradiusproxy


Note that it is important to provide a --radius argument (otherwise ipatokenradiusproxyuser is not added and user-add fails).
Comment 12 Christian Heimes 2018-11-13 11:41:57 UTC 
Fixed upstream
master:
https://pagure.io/freeipa/c/19cd9603876845ea068b7fd0778e2f0d5ac4fc70
https://pagure.io/freeipa/c/1c2c2ee6f815babc0ac59040e03e3075d7319e59
https://pagure.io/freeipa/c/5d603fce5d87a39c0a12bbed880a286b00128f34
https://pagure.io/freeipa/c/da4c12c3e6ac978afc1a365c3aed87eae5832a96
Comment 13 Christian Heimes 2018-11-13 13:26:54 UTC 
Fixed upstream
ipa-4-6:
https://pagure.io/freeipa/c/d5eabd538642cded497424374bcc32c502a16116
https://pagure.io/freeipa/c/d6043c7f0450db3b4a36f636acef46f3efe73f50
https://pagure.io/freeipa/c/3f56ae4322de42530c42b043a3254947569c4a29
https://pagure.io/freeipa/c/97133bbf04002e9748357b7ab4c9d8a5eb48e768
ipa-4-7:
https://pagure.io/freeipa/c/79b7f07cf571b4268de91dedd3bcaa899f0aa3fb
https://pagure.io/freeipa/c/10ccc3bab0b32dc5eaffb91aa280b9a826ba532b
https://pagure.io/freeipa/c/22be7b4deaded601ac3a273116e26eb468a360ce
https://pagure.io/freeipa/c/918dbdfee7a8ffd5264ea780a4a4c02099db9186
Comment 14 Florence Blanc-Renaud 2018-11-14 09:12:18 UTC 
Automated test cases:

test_xmlrpc/test_user_plugin.py
ipatests/test_integration/test_user_permissions.py::TestUserPermissions::test_user_add_withradius
Comment 16 Varun Mylaraiah 2019-05-13 09:51:53 UTC 
Verified
ipa-server-4.6.5-7.el7.x86_64


Console output:
=============

[root@bender ~]# ipa user-add --first="test" --last="user" --user-auth-type=radius --radius-username=testradius --uid=1745050526 --gidnumber=1745050526 testuser1
----------------------
Added user "testuser1"
----------------------
User login: testuser1
First name: test
Last name: user
Full name: test user
Display name: test user
Initials: tu
Home directory: /home/testuser1
GECOS: test user
Login shell: /bin/sh
Principal name: testuser1
Principal alias: testuser1
Email address: testuser1
UID: 1745050526
GID: 1745050526
User authentication types: radius
RADIUS proxy username: testradius
Password: False
Member of groups: ipausers
Kerberos keys available: False


[root@bender ~]# ipa user-show --all testuser1
dn: uid=testuser1,cn=users,cn=accounts,dc=testrelm0513,dc=test
User login: testuser1
First name: test
Last name: user
Full name: test user
Display name: test user
Initials: tu
Home directory: /home/testuser1
GECOS: test user
Login shell: /bin/sh
Principal name: testuser1
Principal alias: testuser1
Email address: testuser1
UID: 1745050526
GID: 1745050526
User authentication types: radius
RADIUS proxy username: testradius
Account disabled: False
Preserved user: False
Password: False
Member of groups: ipausers
Kerberos keys available: False
ipauniqueid: 9fd8975e-7563-11e9-917e-00145efcc4ce
mepmanagedentry: cn=testuser1,cn=groups,cn=accounts,dc=testrelm0513,dc=test
objectclass: top, person, organizationalperson, inetorgperson, inetuser, posixaccount, krbprincipalaux, krbticketpolicyaux, ipaobject, ipasshuser, ipauserauthtypeclass, ipatokenradiusproxyuser, ipaSshGroupOfPubKeys, mepOriginEntry
Comment 17 Varun Mylaraiah 2019-05-20 09:11:36 UTC 
Based on the above observation, marking the bug VERIFIED
Comment 21 errata-xmlrpc 2019-08-06 13:09:05 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2241
Note You need to log in before you can comment on or make changes to this bug.