Description of problem:

yi zhang wrote:
> Hi:
> I get the following error msg , is this a bug?
>
> I do re-use the value for "desc" and "permissions", but the value for
> "targetgroup" is different, How come the "entry already exists"?
>
> [yi@dhcp-137 ipa-delegation]$ ipa permission-add --desc='Manage group
> members' --permissions=write --targetgroup=group11448 manage_grp_11448
> ipa: ERROR: This entry already exists
>
> [yi@dhcp-137 ipa-delegation]$ ipa permission-find manage
> ---------------------
> 5 permissions matched
> ---------------------
> Permission name: manage_host_keytab
> Description: Manage host keytab
> Permissions: write
> Attributes: krbprincipalkey, krblastpwdchange
> Type: host
> Granted to Privilege: hostadmin, enrollhost
>
> Permission name: manage_service_keytab
> Description: Manage service keytab
> Permissions: write
> Attributes: krbprincipalkey, krblastpwdchange
> Type: service
> Granted to Privilege: serviceadmin, admins
>
> Permission name: manage_group_members
> Description: Manage group members
> Permissions: write
> Attributes: member
> Type: group
>
> Permission name: manage_host_keytab
> Description: Manage host keytab
> Permissions: write
> Attributes: krbprincipalkey, krblastpwdchange
> Type: host
> Granted to Privilege: hostadmin, enrollhost
>
> Permission name: manage_service_keytab
> Description: Manage service keytab
> Permissions: write
> Attributes: krbprincipalkey, krblastpwdchange
> Type: service
> Granted to Privilege: serviceadmin, admins
> ----------------------------
> Number of entries returned 5
> ----------------------------
>
>
> Thanks!
>

Ok, I see. The problem is that the descriptions of permissions are in the same namespace, so two permissions with the different names can't use the same description. Probably a bug.

rob 


Version-Release number of selected component (if applicable): ipa-server-2.0-0.2011011115gitc778919.fc14.i686


How reproducible:


Steps to Reproduce:
1.ipa-delegation]$ ipa permission-add --desc='Manage group
members' --permissions=write --targetgroup=group11448 manage_grp_11448 
2.ipa-delegation]$ ipa permission-add --desc='Manage group
members' --permissions=write --targetgroup=ipausers manage_grp 

  
Actual results:
ipa: ERROR: This entry already exists

Expected results:
permission added into ipa

Additional info: