Hide Forgot
Description of problem: When doing a modification using sudorule-mod, the whole string of comma separated groups are accepted as a single value. Version-Release number of selected component (if applicable): ipa-server-2.0.0-25.el6.x86_64 ipa-admintools-2.0.0-25.el6.x86_64 How reproducible: Steps to Reproduce: 1. # ipa sudorule-add-user rule1 --users=sudorule1,sudorule2 Rule name: rule1 Enabled: TRUE External User: sudorule1, sudorule2 ------------------------- Number of members added 2 ------------------------- 2. # ipa sudorule-find rule1 --all --raw dn: ipauniqueid=7eed5c88-964f-11e0-bc9a-525400deab7b,cn=sudorules,cn=sudo,dc=lab,dc=eng,dc=pnq,dc=redhat,dc=com cn: rule1 ipaenabledflag: TRUE externaluser: sudorule2 externaluser: sudorule1 ipauniqueid: 7eed5c88-964f-11e0-bc9a-525400deab7b objectclass: ipaassociation objectclass: ipasudorule ---------------------------- Number of entries returned 1 ---------------------------- 3. # ipa sudorule-mod rule1 --externaluser=sudorule3,sudorule4 Rule name: rule1 Enabled: TRUE External User: sudorule3,sudorule4 Actual results: # ipa sudorule-find rule1 --all --raw dn: ipauniqueid=7eed5c88-964f-11e0-bc9a-525400deab7b,cn=sudorules,cn=sudo,dc=lab,dc=eng,dc=pnq,dc=redhat,dc=com cn: rule1 ipaenabledflag: TRUE externaluser: sudorule3,sudorule4 ipauniqueid: 7eed5c88-964f-11e0-bc9a-525400deab7b objectclass: ipaassociation objectclass: ipasudorule ---------------------------- Number of entries returned 1 ---------------------------- Unable to mod multiple external users using sudorule-mod. Expected results: Should allow to mod multiple external users using sudorule-mod. Additional info: The core problem is likely the same as https://bugzilla.redhat.com/show_bug.cgi?id=711667
https://fedorahosted.org/freeipa/ticket/1320
Related to https://bugzilla.redhat.com/show_bug.cgi?id=711667
Fixed upstream: master: https://fedorahosted.org/freeipa/changeset/d8c479731e6f985f4c4be1e1e4fee858e9eae901
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Cause: Comma-separated values are not handled properly when using the --externaluser option to sudorule-mod. Consequence: The wrong values are being stored in the entry. Fix: These options have been removed from the sudorule-mod command. Use sudorule-add-user instead. Result: --externaluser has been deprecated in sudorule-mod.
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: sudorule-mod_008: ipa sudorule-mod --externaluser :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: ----------------------- Added Sudo Rule "rule1" ----------------------- Rule name: rule1 Description: rule 1 Enabled: TRUE :: [ PASS ] :: Running 'ipa sudorule-add --desc="rule 1" rule1' :: [ PASS ] :: Running 'ipa sudorule-mod rule1 --externaluser=test1,test2 > /tmp/tmp.jHjyYyUOzz/sudorule-mod_008.txt 2>&1' :: [ PASS ] :: File '/tmp/tmp.jHjyYyUOzz/sudorule-mod_008.txt' should contain 'ipa: ERROR: invalid 'externaluser': this option has been deprecated.' ipa: ERROR: invalid 'externaluser': this option has been deprecated. :: [ PASS ] :: Running 'cat /tmp/tmp.jHjyYyUOzz/sudorule-mod_008.txt' :: [11:48:32] :: https://bugzilla.redhat.com/show_bug.cgi?id=713069 ipa: ERROR: invalid 'externaluser': this option has been deprecated. :: [ PASS ] :: Running 'cat /tmp/tmp.jHjyYyUOzz/sudorule-mod_008.txt' ------------------------- Deleted Sudo Rule "rule1" ------------------------- :: [ PASS ] :: Running 'ipa sudorule-del rule1' This option has been deprecated. Verified. Version: ipa-server-2.1.3-7.el6.x86_64
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2011-1533.html