Red Hat Bugzilla – Bug 744410
ipa hbactest does not evaluate indirect members from groups.
Last modified: 2011-12-06 13:42:36 EST
Description of problem: Version-Release number of selected component (if applicable): ipa-server-2.1.2-2.el6.x86_64 How reproducible: Always Steps to Reproduce: 1. [root@bumblebee ~]# ipa group-show hbacusers Group name: hbacusers Description: hbac users GID: 1988800005 Member groups: ipausers Indirect Member users: shanks, ipatest23573 2. [root@bumblebee ~]# ipa hbacrule-show rule2 Rule name: rule2 Enabled: TRUE User Groups: hbacusers Hosts: bumblebee.lab.eng.pnq.redhat.com Source Hosts: mudflap.lab.eng.pnq.redhat.com Services: vsftpd External host: external.lab.eng.pnq.redhat.com 3. [root@bumblebee ~]# ipa hbactest --user=shanks --srchost=external.lab.eng.pnq.redhat.com --host=bumblebee.lab.eng.pnq.redhat.com --service=vsftpd Actual results: --------------------- Access granted: False --------------------- notmatched: rule2 Expected results: --------------------- Access granted: True --------------------- matched: rule2 Additional info:
Upstream ticket: https://fedorahosted.org/freeipa/ticket/1949
Fixed upstream master: 3e1c04f9333ac3f4333d5cf99579e85a44c9573b ipa-2-1: caaacc9a611c5e3230189b2c4636e7d568c21f45
[root@bumblebee ~]# ipa group-show hbacusers Group name: hbacusers Description: test hbacusers GID: 399000005 Member users: shanks Member groups: ipausers Indirect Member users: user1 [root@bumblebee ~]# [root@bumblebee ~]# ipa hbacrule-show rule1 Rule name: rule1 Enabled: TRUE User Groups: hbacusers Hosts: bumblebee.lab.eng.pnq.redhat.com Services: vsftpd External host: external.lab.eng.pnq.redhat.com [root@bumblebee ~]# [root@bumblebee ~]# ipa hbactest --user=shanks --srchost=external.lab.eng.pnq.redhat.com --host=bumblebee.lab.eng.pnq.redhat.com --service=vsftpd --rule=rule1 -------------------- Access granted: True -------------------- matched: rule1 [root@bumblebee ~]# [root@bumblebee ~]# ipa hbactest --user=user1 --srchost=external.lab.eng.pnq.redhat.com --host=bumblebee.lab.eng.pnq.redhat.com --service=vsftpd --rule=rule1 -------------------- Access granted: True -------------------- matched: rule1 [root@bumblebee ~]# Verified. Version: ipa-server-2.1.3-3.el6.x86_64
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Do not document
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2011-1533.html