Bug 2094445
| Summary: | When using ipa group-show admins I receive an error: ipa: ERROR: trusted domain object not found | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Daniel Filho <dcamilof> |
| Component: | ipa | Assignee: | Florence Blanc-Renaud <frenaud> |
| Status: | CLOSED MIGRATED | QA Contact: | ipa-qe <ipa-qe> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.5 | CC: | abokovoy, ftrivino, pasik, rcritten, tscherf |
| Target Milestone: | rc | Keywords: | MigratedToJIRA, Reopened, Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-09-18 19:23:53 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Daniel Filho
2022-06-07 15:47:58 UTC
This looks like a wrong usage of a feature to add ID overrides as group members. You are adding an ID override to the group for the purpose of IPA objects' management here. They are *not* expected to appear in POSIX group membership at all. See https://freeipa.readthedocs.io/en/latest/designs/adtrust/admin-ipa-as-trusted-user.html for the design of this feature. RHEL IdM documentation has corresponding details based on this design. It is not expected to see a user as a part of POSIX group this way. If you need to see an AD user as a part of the POSIX group, you need: - create non-POSIX group - add AD users as an external member of that non-POSIX group - add non-POSIX group as a member of a POSIX group ID overrides serve two very specific roles in IPA: - as a placeholder to specify POSIX attributes of AD users/groups in case they cannot be stored in AD LDAP - as a reference object to assign permissions for IPA object management Adding them as members of groups is only done to allow AD users to manage IPA resources through IPA API (using command line tool, ipa, or Web UI). Hello Alexander/Team. I made a test for a different group than the one demonstrated here. ID overrides serve two very specific roles in IPA: - as a placeholder to specify POSIX attributes of AD users/groups in case they cannot be stored in AD LDAP - as a reference object to assign permissions for IPA object management ----> I believe the customer is using this approach. They are referencing this to the admin's group and when that user is removed from AD, the issue starts to happen. Is it not a bug? Would you mind clarifying if I missed something here? Thanks for all your support. Very Respectfully. Daniel Filho. Daniel, sorry, the mentioning of POSIX user details confused me here. Yes, we need to make sure missing ID overrides reported similar to other 'not found' objects in commands that allow to add them. The issue here is that it wouldn't reduce timeouts to search the missing AD users but that's a different issue. Alexander, Exactly, that's a different issue. Please reach out to me, if you guys need some more informations. Sincerely. Daniel Camilo Filho Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug. This BZ has been automatically migrated to the issues.redhat.com Red Hat Issue Tracker. All future work related to this report will be managed there. Due to differences in account names between systems, some fields were not replicated. Be sure to add yourself to Jira issue's "Watchers" field to continue receiving updates and add others to the "Need Info From" field to continue requesting information. To find the migrated issue, look in the "Links" section for a direct link to the new issue location. The issue key will have an icon of 2 footprints next to it, and begin with "RHEL-" followed by an integer. You can also find this issue by visiting https://issues.redhat.com/issues/?jql= and searching the "Bugzilla Bug" field for this BZ's number, e.g. a search like: "Bugzilla Bug" = 1234567 In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. You can also visit https://access.redhat.com/articles/7032570 for general account information. |