Red Hat Bugzilla – Bug 711671
Comma separated values for --runasexternalgroup option in sudorule-mod are accepted as a single value.
Last modified: 2015-01-04 18:49:10 EST
Description of problem: When doing a modification using sudorule-mod, the whole string of comma separated groups are accepted as a single value. Version-Release number of selected component (if applicable): ipa-server-2.0.0-25.el6.x86_64 ipa-admintools-2.0.0-25.el6.x86_64 How reproducible: Always Steps to Reproduce: 1. ipa sudorule-add shanks-rule1 2. ipa sudorule-add-runasgroup shanks-rule1 --groups=test1,test2,test3,test4 3. ipa sudorule-find shanks-rule1 --all --raw dn: ipauniqueid=f7a20452-918c-11e0-9551-525400deab7b,cn=sudorules,cn=sudo,dc=lab,dc=eng,dc=pnq,dc=redhat,dc=com cn: shanks-rule1 ipaenabledflag: TRUE ipasudorunasextgroup: test1 ipasudorunasextgroup: test3 ipasudorunasextgroup: test2 ipasudorunasextgroup: test4 ipauniqueid: f7a20452-918c-11e0-9551-525400deab7b objectclass: ipaassociation objectclass: ipasudorule ---------------------------- Number of entries returned 1 ---------------------------- 4. ipa sudorule-mod shanks-rule1 --runasexternalgroup=group1,group2,group3,group4 Actual results: # ipa sudorule-find shanks-rule1 --all --raw dn: ipauniqueid=f7a20452-918c-11e0-9551-525400deab7b,cn=sudorules,cn=sudo,dc=lab,dc=eng,dc=pnq,dc=redhat,dc=com cn: shanks-rule1 ipaenabledflag: TRUE ipasudorunasextgroup: group1,group2,group3,group4 ipauniqueid: f7a20452-918c-11e0-9551-525400deab7b objectclass: ipaassociation objectclass: ipasudorule ---------------------------- Number of entries returned 1 ---------------------------- Unable to mod multiple runas external groups using sudorule-mod. Expected results: Should allow to mod multiple runas external groups using sudorule-mod. Additional info:
The core problem is likely the same as BZ 711667 https://fedorahosted.org/freeipa/ticket/1307
master: d8c479731e6f985f4c4be1e1e4fee858e9eae901
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Cause: Comma-separated values are not handled properly when using sudorule-mod to manage runasexternaluser and runasexternalgroup Consequence: The wrong values are being stored in the entry. Fix: These options have been removed from the sudorule-mod command. Use sudorule-add-runasuser and sudurole-runasgroup instead. Result: --runasexternaluser and --runasexternalgroup have been deprecated.
[root@jetfire ~]# ipa sudorule-add-runasgroup shanks-rule1 --groups=testg1,testg2,testg3,testg4 Rule name: shanks-rule1 Enabled: TRUE RunAs External Group: testg1, testg2, testg3, testg4 ------------------------- Number of members added 4 ------------------------- [root@jetfire ~]# ipa sudorule-mod shanks-rule1 --runasexternalgroup=group1,group2,group3,group4 ipa: ERROR: invalid 'runasexternalgroup': this option has been deprecated. [root@jetfire ~]# This option has been deprecated. Verified. Version: ipa-server-2.1.3-7.el6.x86_64ipa-server-2.1.3-7.el6.x86_64
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2011-1533.html