Description of problem: we might want to return a message says: no modification made [yi@dhcp-137 tmp]$ ipa privilege-find newdel4 ------------------- 1 privilege matched ------------------- Privilege name: newdel4 Description: privilege_del_4 ---------------------------- Number of entries returned 1 ---------------------------- [yi@dhcp-137 tmp]$ ipa privilege-mod newdel4 --rename= ipa: ERROR: This entry already exists Version-Release number of selected component (if applicable):ipa-server-2.0-0.2011011115gitc778919.fc14.i686
https://fedorahosted.org/freeipa/ticket/827
I did some testing and I managed to reproduce this issue. But: this issue only occured when I renamed one privilege with --rename= and then another one with the same argument. The first one was renamed to something like cn=None,cn=privileges,cn=pbac,$SUFFIX and when I tried to rename the second one, it correctly failed, because the cn=None is already present. So the behavior is correct, it is only questionable, whether the renaming to cn=None is ok or not.
I am just repeat what Jan Zeleny said above. My test is below: [step 1] create test privilege [yi@dhcp-137 ipa-delegation]$ ipa privilege-add testpri --desc=I_am_unique ------------------------- Added privilege "testpri" ------------------------- Privilege name: testpri Description: I_am_unique [yi@dhcp-137 ipa-delegation]$ ipa privilege-find testpri --all ------------------- 1 privilege matched ------------------- dn: cn=testpri,cn=privileges,cn=pbac,dc=sjc,dc=redhat,dc=com Privilege name: testpri Description: I_am_unique objectclass: nestedgroup, groupofnames, top ---------------------------- Number of entries returned 1 [step 2] rename [yi@dhcp-137 ipa-delegation]$ ipa privilege-mod testpri --rename= ---------------------------- Modified privilege "testpri" ---------------------------- Privilege name: privileges [step 3] search [yi@dhcp-137 ipa-delegation]$ ipa privilege-find testpri --all -------------------- 0 privileges matched -------------------- ---------------------------- Number of entries returned 0 ---------------------------- [yi@dhcp-137 ipa-delegation]$ ipa privilege-find None --all ------------------- 1 privilege matched ------------------- dn: cn=none,cn=privileges,cn=pbac,dc=sjc,dc=redhat,dc=com Privilege name: None Description: I_am_unique objectclass: nestedgroup, groupofnames, top ---------------------------- Number of entries returned 1 ---------------------------- ======= Notes: If i repeat the above rename test, I will get "entry already exist" error due to the second rename will change it to "None" as well
Fixed in: 3e3cc55d24e2bfc4fec80d5e10ce4f3646d7c08c
verified # ipa privilege-mod testpri --rename= ipa: ERROR: invalid 'rename': can't be empty rpm -qi ipa-server | head Name : ipa-server Relocations: (not relocatable) Version : 2.0.0 Vendor: Red Hat, Inc. Release : 23.el6 Build Date: Wed 20 Apr 2011 09:57:13 AM EDT Install Date: Thu 19 May 2011 12:47:52 PM EDT Build Host: x86-003.build.bos.redhat.com Group : System Environment/Base Source RPM: ipa-2.0.0-23.el6.src.rpm Size : 2565882 License: GPLv3+ Signature : RSA/8, Thu 21 Apr 2011 03:48:25 PM EDT, Key ID 199e2f91fd431d51 Packager : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla> URL : http://www.freeipa.org/ Summary : The IPA authentication server