Bug 1577967
| Summary: | Users with user creation/modification privileges fail to add the "--radius-username" option when creating users | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | aheverle |
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> |
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.5 | CC: | amore, cheimes, frenaud, mkosek, mvarun, ndehadra, pasik, pvoborni, rcritten, tscherf |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-4.6.5-1.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-08-06 13:09:05 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1647919 | ||
|
Description
aheverle
2018-05-14 14:13:56 UTC
I think that all this is about is adding ipatokenRadiusUserName to "System: Modify Users" permission. That could be also used as a workaround - adding that attribute to the system permission via permission-mod command. Hi, the command fails because it does not add the auxiliary objectclass ipatokenradiusproxyuser to the user entry. The addition of this object class is done only when ipa user-add/user-mod is called with --radius=<radius proxy configuration>. There is also another issue, though. When the command is called with --radius=<radius proxy configuration>, it first ensures that the provided radius proxy exists, and a non-admin user will not have the ACIs to read cn=radiusproxy,$BASEDN, resulting in the check not finding the radius proxy and the operation to fail. We can create a system permission for adding/reading the radius proxy entries or leave it up to the customer. Upstream ticket: https://pagure.io/freeipa/issue/7569 Upstream ticket for the roles/privileges/permissions: https://pagure.io/freeipa/issue/7570 Workaround: =========== 1. Create a user $USERNAME with "User Administrator" role: kinit admin ipa user-add $USERNAME --first=first --last=last --password ipa role-add-member "User Administrator" --users=$USERNAME 2. Create permission, privilege and role allowing to read Radius Servers: ipa permission-add "Read Radius Servers" --right read --right search --right compare --attrs objectclass --attrs cn --attrs ipatokenRadiusServer --bindtype permission --subtree cn=radiusproxy,$BASEDN --filter="(objectclass=ipatokenradiusconfiguration)" ipa privilege-add "Radius Proxy Readers Priv" ipa privilege-add-permission "Radius Proxy Readers Priv" --permission "Read Radius Servers" ipa role-add "Radius Proxy Reader Role" ipa role-add-privilege "Radius Proxy Reader Role" --privileges "Radius Proxy Readers Priv" 3. Grant the above role to the user: ipa role-add-member "Radius Proxy Reader Role" --users=$USERNAME 4. Add a Radius proxy server: ipa radiusproxy-add myradiusproxy --server radius.example.com --secret 5. As $USERNAME, create a user with --radiususername: kinit $USERNAME ipa user-add --first="test" --last="1234" --user-auth-type=radius --radius-username=testradius --uid=1745050526 --gidnumber=1745050526 test123 --radius myradiusproxy Note that it is important to provide a --radius argument (otherwise ipatokenradiusproxyuser is not added and user-add fails). Fixed upstream master: https://pagure.io/freeipa/c/19cd9603876845ea068b7fd0778e2f0d5ac4fc70 https://pagure.io/freeipa/c/1c2c2ee6f815babc0ac59040e03e3075d7319e59 https://pagure.io/freeipa/c/5d603fce5d87a39c0a12bbed880a286b00128f34 https://pagure.io/freeipa/c/da4c12c3e6ac978afc1a365c3aed87eae5832a96 Fixed upstream ipa-4-6: https://pagure.io/freeipa/c/d5eabd538642cded497424374bcc32c502a16116 https://pagure.io/freeipa/c/d6043c7f0450db3b4a36f636acef46f3efe73f50 https://pagure.io/freeipa/c/3f56ae4322de42530c42b043a3254947569c4a29 https://pagure.io/freeipa/c/97133bbf04002e9748357b7ab4c9d8a5eb48e768 ipa-4-7: https://pagure.io/freeipa/c/79b7f07cf571b4268de91dedd3bcaa899f0aa3fb https://pagure.io/freeipa/c/10ccc3bab0b32dc5eaffb91aa280b9a826ba532b https://pagure.io/freeipa/c/22be7b4deaded601ac3a273116e26eb468a360ce https://pagure.io/freeipa/c/918dbdfee7a8ffd5264ea780a4a4c02099db9186 Automated test cases: test_xmlrpc/test_user_plugin.py ipatests/test_integration/test_user_permissions.py::TestUserPermissions::test_user_add_withradius Verified ipa-server-4.6.5-7.el7.x86_64 Console output: ============= [root@bender ~]# ipa user-add --first="test" --last="user" --user-auth-type=radius --radius-username=testradius --uid=1745050526 --gidnumber=1745050526 testuser1 ---------------------- Added user "testuser1" ---------------------- User login: testuser1 First name: test Last name: user Full name: test user Display name: test user Initials: tu Home directory: /home/testuser1 GECOS: test user Login shell: /bin/sh Principal name: testuser1 Principal alias: testuser1 Email address: testuser1 UID: 1745050526 GID: 1745050526 User authentication types: radius RADIUS proxy username: testradius Password: False Member of groups: ipausers Kerberos keys available: False [root@bender ~]# ipa user-show --all testuser1 dn: uid=testuser1,cn=users,cn=accounts,dc=testrelm0513,dc=test User login: testuser1 First name: test Last name: user Full name: test user Display name: test user Initials: tu Home directory: /home/testuser1 GECOS: test user Login shell: /bin/sh Principal name: testuser1 Principal alias: testuser1 Email address: testuser1 UID: 1745050526 GID: 1745050526 User authentication types: radius RADIUS proxy username: testradius Account disabled: False Preserved user: False Password: False Member of groups: ipausers Kerberos keys available: False ipauniqueid: 9fd8975e-7563-11e9-917e-00145efcc4ce mepmanagedentry: cn=testuser1,cn=groups,cn=accounts,dc=testrelm0513,dc=test objectclass: top, person, organizationalperson, inetorgperson, inetuser, posixaccount, krbprincipalaux, krbticketpolicyaux, ipaobject, ipasshuser, ipauserauthtypeclass, ipatokenradiusproxyuser, ipaSshGroupOfPubKeys, mepOriginEntry Based on the above observation, marking the bug VERIFIED Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2241 |