Hide Forgot
Description of problem: I just found a tricky way to remove attribute with role-mod. Please check the test below Version-Release number of selected component (if applicable): ipa-server-2.0-0.2011011115gitc778919.fc14.i686 How reproducible: Steps to Reproduce: 1. [before] [yi@dhcp-137 ipa-delegation]$ ipa role-find testRole01 -------------- 1 role matched -------------- Role name: testrole01 Description: 4_role_mod_1004 ---------------------------- Number of entries returned 1 ---------------------------- 2. [a tricky way to remove "description" ] [yi@dhcp-137 ipa-delegation]$ ipa role-mod testRole01 --desc= --rename=NewTestRole01 -------------------------- Modified role "testrole01" -------------------------- Role name: newtestrole01 3. [ after ] [yi@dhcp-137 ipa-delegation]$ ipa role-find newtestrole01 -------------- 1 role matched -------------- Role name: newtestrole01 ---------------------------- Number of entries returned 1 ---------------------------- [yi@dhcp-137 ipa-delegation]$ ipa role-find newtestrole01 --all -------------- 1 role matched -------------- dn: cn=newtestrole01,cn=roles,cn=accounts,dc=sjc,dc=redhat,dc=com Role name: newtestrole01 objectclass: groupofnames, nestedgroup, top ---------------------------- Number of entries returned 1 ---------------------------- [yi@dhcp-137 ipa-delegation]$ ipa role-find newtestrole01 --all --raw -------------- 1 role matched -------------- dn: cn=newtestrole01,cn=roles,cn=accounts,dc=sjc,dc=redhat,dc=com cn: newtestrole01 objectclass: groupofnames objectclass: nestedgroup objectclass: top ---------------------------- Number of entries returned 1 ----------------------------
This looks like a bug to me, if an attribute is required we probably shouldn't allow renaming it to an empty string (except for setattr). CLI doesn't allow entering it empty when calling -add anyway. https://fedorahosted.org/freeipa/ticket/852
Setting to an empty value will delete the attribute. What is surprising to me is I think description is required by the schema, so it is unclear why it is allowed at all.
master: 81020a2ffaa13edbdaa4ff377b748fb623fe0c09