2234480 – Allowing idp-user-id modification with ipa user-mod after removing idp

This bug has been migrated to another issue tracking site. It has been closed here and may no longer be being monitored.

If you would like to get updates for this issue, or to participate in it, you may do so at Red Hat Issue Tracker .

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 2234480 - Allowing idp-user-id modification with ipa user-mod after removing idp

Summary: Allowing idp-user-id modification with ipa user-mod after removing idp

Keywords:
Status:	CLOSED MIGRATED
Alias:	None
Product:	Red Hat Enterprise Linux 8
Classification:	Red Hat
Component:	ipa
Sub Component:
Version:	8.9
Hardware:	x86_64
OS:	Linux
Priority:	unspecified
Severity:	unspecified
Target Milestone:	rc
Target Release:	---
Assignee:	Florence Blanc-Renaud
QA Contact:	ipa-qe
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:	2234481
TreeView+	depends on / blocked

Reported:	2023-08-24 15:20 UTC by Varun Mylaraiah
Modified:	2023-09-18 23:12 UTC (History)
CC List:	4 users (show)
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Clones:	2234481 (view as bug list)
Environment:
Last Closed:	2023-09-18 23:12:05 UTC
Type:	Bug
Target Upstream Version:
Embargoed:
Dependent Products:

Attachments	(Terms of Use)

Links
System	ID	Priority	Status	Summary	Last Updated
Fedora Pagure	freeipa issue 9433	None	None	None	2023-08-25 13:33:46 UTC
Red Hat Issue Tracker	FREEIPA-10307	None	None	None	2023-09-01 17:24:56 UTC
Red Hat Issue Tracker	RHEL-4965	None	Migrated	None	2023-09-18 23:11:57 UTC
Red Hat Issue Tracker	RHELPLAN-166445	None	None	None	2023-08-24 15:23:18 UTC

Description Varun Mylaraiah 2023-08-24 15:20:13 UTC

Description of problem:
Allowing idp-user-id modification with ipa user-mod after removing idp.

Version-Release number of selected component (if applicable):
ipa-server-4.9.12-7


Steps to Reproduce:
1. Modify user without --idp attribute ==== ipa user-mod fails as expected
    (ipa user-mod idpuser1 --idp-user-id=new.mydomain2.test)

2. Modify user with --idp attribute
    (ipa user-mod idpuser1 --idp=MytestIdP --idp-user-id=new.mydomain2.test)

3. Remove idp from server
    (ipa idp-del MytestIdP)

4. Modify user without --idp attribute  ==== ipa user-mod command succeed 
    (ipa user-mod idpuser1 --idp-user-id=newtest.domain.test)

Actual results:
ipa user-mod (Step 4) succeeded after IDP removed

Expected results:
Step 4 should report the error.



Additional info:

[root@master ~]# ipa user-show idpuser1
  User login: idpuser1
  First name: useridp
  Last name: user
  Home directory: /home/idpuser1
  Login shell: /bin/sh
  Principal name: idpuser1
  Principal alias: idpuser1
  Email address: idpuser1
  UID: 1381800005
  GID: 1381800005
  Account disabled: False
  Password: False
  Member of groups: ipausers
  Kerberos keys available: False
  
[root@master ~]# ipa idp-show MytestIdP
  Identity Provider reference name: MytestIdP
  Authorization URI: https://accounts.google.com/o/oauth2/auth
  Device authorization URI: https://oauth2.googleapis.com/device/code
  Token URI: https://oauth2.googleapis.com/token
  User info URI: https://openidconnect.googleapis.com/v1/userinfo
  JWKS URI: https://www.googleapis.com/oauth2/v3/certs
  Client identifier: i1qawe23
  Scope: openid email
  External IdP user identifier attribute: email
  
  
  - 1. Modify user without --idp attribute ==== ipa user-mod fails as expected
  
[root@master ~]# ipa user-mod idpuser1 --idp-user-id=new.mydomain2.test
ipa: ERROR: attribute "ipaIdpSub" not allowed


  - 2. Modify user with --idp attribute

[root@master ~]# ipa user-mod idpuser1 --idp=MytestIdP --idp-user-id=new.mydomain2.test
------------------------
Modified user "idpuser1"
------------------------
  User login: idpuser1
  First name: useridp
  Last name: user
  Home directory: /home/idpuser1
  Login shell: /bin/sh
  Principal name: idpuser1
  Principal alias: idpuser1
  Email address: idpuser1
  UID: 1381800005
  GID: 1381800005
  External IdP configuration: MytestIdP
  External IdP user identifier: new.mydomain2.test
  Account disabled: False
  Password: False
  Member of groups: ipausers
  Kerberos keys available: False
  
  
   - 3. Remove idp from server
   
 [root@master ~]# ipa idp-del MytestIdP
-----------------------------------------------
Deleted Identity Provider reference "MytestIdP"
-----------------------------------------------
 
  -  4. Modify user without --idp attribute  ==== ipa user-mod command succeed 

[root@master ~]# ipa user-mod idpuser1 --idp-user-id=newtest.domain.test
------------------------
Modified user "idpuser1"
------------------------
  User login: idpuser1
  First name: useridp
  Last name: user
  Home directory: /home/idpuser1
  Login shell: /bin/sh
  Principal name: idpuser1
  Principal alias: idpuser1
  Email address: idpuser1
  UID: 1381800005
  GID: 1381800005
  External IdP user identifier: newtest.domain.test
  Account disabled: False
  Password: False
  Member of groups: ipausers
  Kerberos keys available: False

Comment 1 Florence Blanc-Renaud 2023-08-25 08:09:29 UTC

1. IMO the part "Modify user without --idp attribute" should succeed:

[root@master ~]# ipa user-mod idpuser1 --idp-user-id=new.mydomain2.test
ipa: ERROR: attribute "ipaIdpSub" not allowed

There is a function called on add/mod that is checking if some objectclasses are missing (check_object_class, https://github.com/freeipa/freeipa/blob/master/ipaserver/plugins/baseuser.py#L719). This function should add the objectclass 
ipaIdpUser to the user entry if the attribute ipaIdpSub is in the add/mod.

2. For better usability, we should add a warning when removing an idp if there are users linked to this idp. It could look like:

# ipa idp-del MytestIdP
WARNING: the idp 'MytestIdP' is referenced by users 'MyUserA', 'MyUserB', please update the users by removing their External IdP configuration.
-----------------------------------------------
Deleted Identity Provider reference "MytestIdP"
-----------------------------------------------

Comment 2 Alexander Bokovoy 2023-08-25 08:59:58 UTC

I am concerned with all these requests that effectively ask for a full-database scan of the connected entries. It is going to be problematic for several reasons as it is subject to the bound LDAP user's search and access limits. We might not be able to see all users which reference this IdP entry.

The ipaidpconfiglink is DN is already handled by the referential integrity plugin. This means a removal of IdP definition means removal of that attribute from the user entry automatically. Perhaps referential integrity plugin could be extended to allow removal of associated attributes from the entry that references ipaidpconfiglink with the removed DN? Right now it cannot do that, it only removes that individual attribute from the affected entry.

Comment 3 Florence Blanc-Renaud 2023-08-25 10:32:43 UTC

My bad, I understood that removing an IdP did not remove the idp reference in the user entry. Alexander clarified and indeed there is the referential integrity plugin that updates the user entry and removes the value "External IdP configuration: myidp"

So for this BZ, I think we should fix the first part, i.e. automatically append the objectclass ipaIdpUser to the user entry if the attribute ipaIdpSub is in the add/mod.

Comment 4 Florence Blanc-Renaud 2023-08-25 13:32:45 UTC

Upstream ticket:
https://pagure.io/freeipa/issue/9433

Comment 5 Rob Crittenden 2023-08-30 13:16:41 UTC

Fixed upstream
master:
https://pagure.io/freeipa/c/0654fb3737febf3d9836cdd2a98352c34c447a6f

Comment 6 Rob Crittenden 2023-09-01 17:23:50 UTC

Fixed upstream
ipa-4-11:
https://pagure.io/freeipa/c/f16b6e3e0a1f3dc507c3150c347276255f3b3e72

Fixed upstream
ipa-4-10:
https://pagure.io/freeipa/c/1b69b0ee2578b8e5cad6a47f37f46c509fddee42

Fixed upstream
ipa-4-9:
https://pagure.io/freeipa/c/7e5740f534893487f5a61907ebd6e3677f0beecc

Comment 7 RHEL Program Management 2023-09-18 23:11:48 UTC

Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug.

Comment 8 RHEL Program Management 2023-09-18 23:12:05 UTC

This BZ has been automatically migrated to the issues.redhat.com Red Hat Issue Tracker. All future work related to this report will be managed there.

Due to differences in account names between systems, some fields were not replicated.  Be sure to add yourself to Jira issue's "Watchers" field to continue receiving updates and add others to the "Need Info From" field to continue requesting information.

To find the migrated issue, look in the "Links" section for a direct link to the new issue location. The issue key will have an icon of 2 footprints next to it, and begin with "RHEL-" followed by an integer.  You can also find this issue by visiting https://issues.redhat.com/issues/?jql= and searching the "Bugzilla Bug" field for this BZ's number, e.g. a search like:

"Bugzilla Bug" = 1234567

In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. You can also visit https://access.redhat.com/articles/7032570 for general account information.

Note You need to log in before you can comment on or make changes to this bug.