Bug 713069 - Comma separated values for --externaluser option in sudorule-mod are accepted as a single value.
Summary: Comma separated values for --externaluser option in sudorule-mod are accepted...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa
Version: 6.2
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Rob Crittenden
QA Contact: Chandrasekar Kannan
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-06-14 07:23 UTC by Gowrishankar Rajaiyan
Modified: 2015-01-04 23:49 UTC (History)
4 users (show)

Fixed In Version: ipa-2.1.0-1.el6
Doc Type: Bug Fix
Doc Text:
Cause: Comma-separated values are not handled properly when using the --externaluser option to sudorule-mod. Consequence: The wrong values are being stored in the entry. Fix: These options have been removed from the sudorule-mod command. Use sudorule-add-user instead. Result: --externaluser has been deprecated in sudorule-mod.
Clone Of:
Environment:
Last Closed: 2011-12-06 18:33:41 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Bugzilla 711667 None None None Never
Red Hat Product Errata RHSA-2011:1533 normal SHIPPED_LIVE Moderate: ipa security and bug fix update 2011-12-06 01:23:31 UTC

Internal Links: 711667

Description Gowrishankar Rajaiyan 2011-06-14 07:23:24 UTC
Description of problem:
When doing a modification using sudorule-mod, the whole string of comma
separated groups are accepted as a single value.


Version-Release number of selected component (if applicable):
ipa-server-2.0.0-25.el6.x86_64
ipa-admintools-2.0.0-25.el6.x86_64

How reproducible:


Steps to Reproduce:
1. # ipa sudorule-add-user rule1 --users=sudorule1,sudorule2
  Rule name: rule1
  Enabled: TRUE
  External User: sudorule1, sudorule2
-------------------------
Number of members added 2
-------------------------

2. # ipa sudorule-find rule1 --all --raw
  dn: ipauniqueid=7eed5c88-964f-11e0-bc9a-525400deab7b,cn=sudorules,cn=sudo,dc=lab,dc=eng,dc=pnq,dc=redhat,dc=com
  cn: rule1
  ipaenabledflag: TRUE
  externaluser: sudorule2
  externaluser: sudorule1
  ipauniqueid: 7eed5c88-964f-11e0-bc9a-525400deab7b
  objectclass: ipaassociation
  objectclass: ipasudorule
----------------------------
Number of entries returned 1
----------------------------

3. # ipa sudorule-mod rule1 --externaluser=sudorule3,sudorule4
  Rule name: rule1
  Enabled: TRUE
  External User: sudorule3,sudorule4


  
Actual results:
# ipa sudorule-find rule1 --all --raw
  dn: ipauniqueid=7eed5c88-964f-11e0-bc9a-525400deab7b,cn=sudorules,cn=sudo,dc=lab,dc=eng,dc=pnq,dc=redhat,dc=com
  cn: rule1
  ipaenabledflag: TRUE
  externaluser: sudorule3,sudorule4
  ipauniqueid: 7eed5c88-964f-11e0-bc9a-525400deab7b
  objectclass: ipaassociation
  objectclass: ipasudorule
----------------------------
Number of entries returned 1
----------------------------

Unable to mod multiple external users using sudorule-mod.

Expected results:
Should allow to mod multiple external users using sudorule-mod.

Additional info:
The core problem is likely the same as https://bugzilla.redhat.com/show_bug.cgi?id=711667

Comment 2 Martin Kosek 2011-06-14 10:17:21 UTC
https://fedorahosted.org/freeipa/ticket/1320

Comment 3 Martin Kosek 2011-06-14 10:19:36 UTC
Related to https://bugzilla.redhat.com/show_bug.cgi?id=711667

Comment 4 Martin Kosek 2011-07-29 13:42:00 UTC
Fixed upstream:
master: https://fedorahosted.org/freeipa/changeset/d8c479731e6f985f4c4be1e1e4fee858e9eae901

Comment 6 Rob Crittenden 2011-10-31 19:57:48 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause: Comma-separated values are not handled properly when using the --externaluser option to sudorule-mod.
Consequence: The wrong values are being stored in the entry.
Fix: These options have been removed from the sudorule-mod command. Use sudorule-add-user instead.
Result: --externaluser has been deprecated in sudorule-mod.

Comment 7 Gowrishankar Rajaiyan 2011-11-02 06:09:58 UTC
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: sudorule-mod_008: ipa sudorule-mod --externaluser
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

-----------------------
Added Sudo Rule "rule1"
-----------------------
  Rule name: rule1
  Description: rule 1
  Enabled: TRUE
:: [   PASS   ] :: Running 'ipa sudorule-add --desc="rule 1" rule1'
:: [   PASS   ] :: Running 'ipa sudorule-mod rule1 --externaluser=test1,test2 > /tmp/tmp.jHjyYyUOzz/sudorule-mod_008.txt 2>&1'
:: [   PASS   ] :: File '/tmp/tmp.jHjyYyUOzz/sudorule-mod_008.txt' should contain 'ipa: ERROR: invalid 'externaluser': this option has been deprecated.'
ipa: ERROR: invalid 'externaluser': this option has been deprecated.
:: [   PASS   ] :: Running 'cat /tmp/tmp.jHjyYyUOzz/sudorule-mod_008.txt'
:: [11:48:32] ::  https://bugzilla.redhat.com/show_bug.cgi?id=713069
ipa: ERROR: invalid 'externaluser': this option has been deprecated.
:: [   PASS   ] :: Running 'cat /tmp/tmp.jHjyYyUOzz/sudorule-mod_008.txt'
-------------------------
Deleted Sudo Rule "rule1"
-------------------------
:: [   PASS   ] :: Running 'ipa sudorule-del rule1'


This option has been deprecated. Verified. 
Version: ipa-server-2.1.3-7.el6.x86_64

Comment 8 errata-xmlrpc 2011-12-06 18:33:41 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2011-1533.html


Note You need to log in before you can comment on or make changes to this bug.