This bug has been migrated to another issue tracking site. It has been closed here and may no longer be being monitored.

If you would like to get updates for this issue, or to participate in it, you may do so at Red Hat Issue Tracker .
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2234481 - Allowing idp-user-id modification with ipa user-mod after removing idp
Summary: Allowing idp-user-id modification with ipa user-mod after removing idp
Keywords:
Status: CLOSED MIGRATED
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: ipa
Version: 9.3
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Florence Blanc-Renaud
QA Contact: ipa-qe
URL:
Whiteboard:
Depends On: 2234480
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-08-24 15:22 UTC by Varun Mylaraiah
Modified: 2023-09-18 23:17 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 2234480
Environment:
Last Closed: 2023-09-18 23:17:08 UTC
Type: Bug
Target Upstream Version:
Embargoed:
pm-rhel: mirror+

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Fedora Pagure freeipa issue 9433 0 None None None 2023-08-25 13:33:38 UTC
Red Hat Issue Tracker FREEIPA-10306 0 None None None 2023-08-24 15:23:08 UTC
Red Hat Issue Tracker   RHEL-4966 0 None Migrated None 2023-09-18 23:14:11 UTC
Red Hat Issue Tracker RHELPLAN-166444 0 None None None 2023-08-25 08:30:09 UTC

Description Varun Mylaraiah 2023-08-24 15:22:09 UTC 
+++ This bug was initially created as a clone of Bug #2234480 +++

Description of problem:
Allowing idp-user-id modification with ipa user-mod after removing idp.

Version-Release number of selected component (if applicable):
ipa-server-4.10.2-4.el9.x86_64

Steps to Reproduce:
1. Modify user without --idp attribute ==== ipa user-mod fails as expected
    (ipa user-mod idpuser1 --idp-user-id=new.mydomain2.test)

2. Modify user with --idp attribute
    (ipa user-mod idpuser1 --idp=MytestIdP --idp-user-id=new.mydomain2.test)

3. Remove idp from server
    (ipa idp-del MytestIdP)

4. Modify user without --idp attribute  ==== ipa user-mod command succeed 
    (ipa user-mod idpuser1 --idp-user-id=newtest.domain.test)

Actual results:
ipa user-mod (Step 4) succeeded after IDP removed

Expected results:
Step 4 should report the error.



Additional info:

[root@master ~]# ipa user-show idpuser1
  User login: idpuser1
  First name: useridp
  Last name: user
  Home directory: /home/idpuser1
  Login shell: /bin/sh
  Principal name: idpuser1
  Principal alias: idpuser1
  Email address: idpuser1
  UID: 1381800005
  GID: 1381800005
  Account disabled: False
  Password: False
  Member of groups: ipausers
  Kerberos keys available: False
  
[root@master ~]# ipa idp-show MytestIdP
  Identity Provider reference name: MytestIdP
  Authorization URI: https://accounts.google.com/o/oauth2/auth
  Device authorization URI: https://oauth2.googleapis.com/device/code
  Token URI: https://oauth2.googleapis.com/token
  User info URI: https://openidconnect.googleapis.com/v1/userinfo
  JWKS URI: https://www.googleapis.com/oauth2/v3/certs
  Client identifier: i1qawe23
  Scope: openid email
  External IdP user identifier attribute: email
  
  
  - 1. Modify user without --idp attribute ==== ipa user-mod fails as expected
  
[root@master ~]# ipa user-mod idpuser1 --idp-user-id=new.mydomain2.test
ipa: ERROR: attribute "ipaIdpSub" not allowed


  - 2. Modify user with --idp attribute

[root@master ~]# ipa user-mod idpuser1 --idp=MytestIdP --idp-user-id=new.mydomain2.test
------------------------
Modified user "idpuser1"
------------------------
  User login: idpuser1
  First name: useridp
  Last name: user
  Home directory: /home/idpuser1
  Login shell: /bin/sh
  Principal name: idpuser1
  Principal alias: idpuser1
  Email address: idpuser1
  UID: 1381800005
  GID: 1381800005
  External IdP configuration: MytestIdP
  External IdP user identifier: new.mydomain2.test
  Account disabled: False
  Password: False
  Member of groups: ipausers
  Kerberos keys available: False
  
  
   - 3. Remove idp from server
   
 [root@master ~]# ipa idp-del MytestIdP
-----------------------------------------------
Deleted Identity Provider reference "MytestIdP"
-----------------------------------------------
 
  -  4. Modify user without --idp attribute  ==== ipa user-mod command succeed 

[root@master ~]# ipa user-mod idpuser1 --idp-user-id=newtest.domain.test
------------------------
Modified user "idpuser1"
------------------------
  User login: idpuser1
  First name: useridp
  Last name: user
  Home directory: /home/idpuser1
  Login shell: /bin/sh
  Principal name: idpuser1
  Principal alias: idpuser1
  Email address: idpuser1
  UID: 1381800005
  GID: 1381800005
  External IdP user identifier: newtest.domain.test
  Account disabled: False
  Password: False
  Member of groups: ipausers
  Kerberos keys available: False
Comment 1 Florence Blanc-Renaud 2023-08-25 08:27:07 UTC 
This BZ is a RHEL 9 clone of the RHEL8 BZ #2234480, let's use #2234480 for analysis.
Comment 2 Florence Blanc-Renaud 2023-08-25 13:32:48 UTC 
Upstream ticket:
https://pagure.io/freeipa/issue/9433
Comment 3 Rob Crittenden 2023-08-30 13:16:49 UTC 
Fixed upstream
master:
https://pagure.io/freeipa/c/0654fb3737febf3d9836cdd2a98352c34c447a6f
Comment 4 Rob Crittenden 2023-09-01 17:23:54 UTC 
Fixed upstream
ipa-4-11:
https://pagure.io/freeipa/c/f16b6e3e0a1f3dc507c3150c347276255f3b3e72

Fixed upstream
ipa-4-10:
https://pagure.io/freeipa/c/1b69b0ee2578b8e5cad6a47f37f46c509fddee42

Fixed upstream
ipa-4-9:
https://pagure.io/freeipa/c/7e5740f534893487f5a61907ebd6e3677f0beecc
Comment 5 RHEL Program Management 2023-09-18 23:11:54 UTC 
Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug.
Comment 6 RHEL Program Management 2023-09-18 23:17:08 UTC 
This BZ has been automatically migrated to the issues.redhat.com Red Hat Issue Tracker. All future work related to this report will be managed there.

Due to differences in account names between systems, some fields were not replicated.  Be sure to add yourself to Jira issue's "Watchers" field to continue receiving updates and add others to the "Need Info From" field to continue requesting information.

To find the migrated issue, look in the "Links" section for a direct link to the new issue location. The issue key will have an icon of 2 footprints next to it, and begin with "RHEL-" followed by an integer.  You can also find this issue by visiting https://issues.redhat.com/issues/?jql= and searching the "Bugzilla Bug" field for this BZ's number, e.g. a search like:

"Bugzilla Bug" = 1234567

In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. You can also visit https://access.redhat.com/articles/7032570 for general account information.
Note You need to log in before you can comment on or make changes to this bug.