Bug 1884819
| Summary: | IdM Web UI shows users as disabled [rhel-7.9.z] | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Scott Nicholas <scott.a.nicholas4.ctr> | ||||||
| Component: | ipa | Assignee: | Florence Blanc-Renaud <frenaud> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> | ||||||
| Severity: | urgent | Docs Contact: | |||||||
| Priority: | urgent | ||||||||
| Version: | 7.9 | CC: | jreznik, ksiddiqu, mpolovka, pcech, rcritten, stsymbal, tscherf | ||||||
| Target Milestone: | rc | Keywords: | Triaged, ZStream | ||||||
| Target Release: | --- | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | ipa-4.6.8-5.el7_9.4 | Doc Type: | If docs needed, set a value | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2021-03-16 13:56:37 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
|
Description
Scott Nicholas
2020-10-02 21:11:00 UTC
Upstream ticket: https://pagure.io/freeipa/issue/8203 The issue has already been reported upstream in ticket 8203, and can be reproduced. Install RHEL 7.9 ipa server in CA-less mode. Create a user: kinit admin; ipa user-add idmuser --first idm --last user --user-auth-type otp In the WebUI navigate to the user info, the User Authentication Type box for OTP is not checked and the fields related to password policy are not editable/visible. Similar issue on RHEL 8: https://bugzilla.redhat.com/show_bug.cgi?id=1835853 I tried searching upstream but possibly used the wrong words. I can see if the cert.py patch applies here. It is already fixed in upstream: https://pagure.io/freeipa/issue/8369 master: https://pagure.io/freeipa/c/19544d53aeada733eb63d596be0a8576b17b9d04 ipa-4-8: https://pagure.io/freeipa/c/60a58eac02ed2c0741fbce3c1fb3acceef61fdbc ipa-4-6: https://pagure.io/freeipa/c/eb8cb4d941ed8d4d76772a7a7d65c018497cb615 Upstream ticket: https://pagure.io/freeipa/issue/8369 I applied the upstream commit eb8cb4d to my system with ipa-server-4.6.8-5.el7 and it does fix this issue. Verified manually (automation pending) using ipa-server-4.6.8-5.el7_9.4.x86_64 on RHEL7.9z. Setup: 1. # created certificates for ca-less install 2. ipa-server-install --http-cert-file /tmp/nssdb/server.p12 --dirsrv-cert-file /tmp/nssdb/server.p12 --http-pin $PIN --dirsrv-pin $PIN --domain dom-$(hostname -f) --realm DOM-$(hostname -f | tr '[:lower:]' '[:upper:]') -a $PASS -p $PASS --no-pkinit -U 3. kinit admin; ipa user-add idmuser --first idm --last user --user-auth-type otp 4. # login to WebUI 5. check user idmuser -> user is enabled, all authentication attributes are correctly selected, it's possible to reset password 6. create new users from WebUI -> all are enabled, it's possible to reset their passwords See attached screenshots. Coverage flag will be updated when automation is finished. Created attachment 1757105 [details]
user list showing the users created are enabled
Created attachment 1757106 [details]
user edit window showing correct attributes
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: ipa security and bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:0860 |